Task Manager Creator's Defense of Windows 11 Backfires as Unstoppable GDID Tracking is Exposed

Microsoft’s Global Device Identifier (GDID) has become the center of a massive privacy controversy, proving so obscure that even the creator of the Windows Task Manager publicly misunderstood how it works. Former Microsoft engineer Dave Plummer attempted to defend the company's tracking practices on X, only to be hit with a community note revealing he was confusing local GUIDs with the server-assigned GDID that the FBI recently used to track a hacker across three countries. This incident exposes a deeply embedded, un-toggleable tracking mechanism within Windows 11 that operates entirely outside standard diagnostic telemetry.

The controversy ignited when the Linus Tech Tips WAN Show covered recent reports about Microsoft's GDID. Host Linus Sebastian labeled the tracking "a serious problem," while co-host Luke Lafreniere discussed migrating to a Linux distribution. When X user Orwell Day clipped the segment, noting that Microsoft "admitted to using a global unique device identifier to help track a user across 3 countries, negating any value of using a VPN," Plummer stepped in with a lengthy technical rebuttal.

Plummer, widely respected for creating Windows Pinball, Product Activation, and the recent 2.5KB Notepad alternative RetroPad, opened his defense sharply. "As usual, Linus brings you the drama for the clicks, and then I’ve got to explain it for free," Plummer wrote. However, his entire argument centered on GUIDs (Globally Unique Identifiers), completely missing the actual technology in question.

He correctly explained that a Windows Identifier generated with modern functions cannot be traced back to a MAC address. Microsoft’s documentation for UuidCreateSequential confirms that the standard creation tool was changed to remove MAC address embedding. Plummer even broke down a version 1 UUID format to show how a node ID is exposed:

1be8d85d-63d1-11e1-80db-b8ac6fbe26e1

While every technical claim Plummer made about GUIDs was factually accurate, it was entirely irrelevant to the FBI case. Community notes on X, proposed by an experimental AI contributor, quickly flagged the discrepancy. Commenters pointed out that the tracking relied on a server-assigned, account-linked ID that phones home to Microsoft, not a locally generated UUID. Realizing his error, Plummer issued a candid retraction.

I’m not wrong in the above, but I’m still talking out of my butt needlessly because he’s actually talking about GDID whereas I’m talking about how to uniquely identify a machine via a GUID. I should actually watch the WAN show instead of inferring from a clip summary, and that’s on me!

- Dave Plummer, Former Microsoft Engineer

Both are identifiers that appear within Windows internals, but their origins and purposes are fundamentally different. A GUID (or UUID) is a 128-bit value generated locally by your PC using an algorithm. Windows does not need internet access to create one, and software uses them constantly for file identifiers, database keys, and COM object registration.

In contrast, GDID is a 64-bit Device PUID (Passport Unique ID). It is assigned directly by Microsoft’s login servers the moment a Windows installation provisions itself against a Microsoft Account. The complaint against alleged Scattered Spider hacker Peter Stokes quoted a Microsoft representative describing it as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system."

Feature	GUID / UUID	GDID
Value Length	128-bit value	64-bit value
Generation	Generated locally by the device	Assigned by Microsoft’s servers
Format	Dashed hex blocks	g: followed by a decimal number
Hardware Link	Some versions embed a real MAC address	Not derived from hardware
Primary Use	Files, database keys, software identifiers	Identify a Windows installation across services
Account Requirement	No account required	Minted upon Microsoft Account sign-in
Internet Access	Offline creation	Requires contacting login.live.com

The distinction between these identifiers became a matter of federal law enforcement in May 2025. Investigators were tracking an attack on a US jewelry retailer to an ngrok account created via a VPN proxy address - a dead end for traditional IP tracking. However, Microsoft’s records showed a specific device visited the ngrok signup page at the exact minute the account was created.

g:6755467234350028

Three hours later, that exact same GDID visited the retailer’s website through the same proxy. This gave the FBI a persistent device to follow instead of a rotating IP address. Agents matched the GDID’s IP history against known logins to Stokes’ Snapchat, Apple, Facebook, and Ubisoft accounts across Estonia, New York, and Thailand over eight months, eventually leading to his capture.

For privacy-conscious users, the most alarming revelation is that GDID cannot be turned off. Independent testing by French tech blog Korben revealed that disabling standard Windows telemetry toggles does not stop the GDID from being reported. The identifier bypasses the diagnostic telemetry pipeline entirely.

The chain of custody for GDID runs through specific system services. The Microsoft Account service (wlidsvc) contacts the login server, retrieves the Device PUID, and writes it to the registry in plain text at the following location:

HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties

The Connected Devices Platform reads this value, and the Delivery Optimization service reports it back to Microsoft whenever a PC shares update data peer-to-peer. Deleting the registry key is futile; the Microsoft Store simply re-downloads the same value within seconds because the master record lives on Microsoft's servers.

Microsoft did not build GDID for surveillance; it is the modern descendant of Windows Product Activation introduced with Windows XP in 2001. The group behind the Microsoft Activation Scripts project, Massgrave, explained on X that Windows setup sends hardware information (Disk, SMBIOS, and TPM info) to Microsoft to receive these tokens. "It’s impossible to prevent Windows from getting a GDID without breaking activation and UWP apps," Massgrave concluded.

Apple utilizes similar persistent identifiers for ecosystem syncing, but handles third-party isolation differently. Every Mac features a permanent Hardware UUID generated from the logic board, which survives OS reinstalls. Apple Community threads confirm the UUID changes only after a logic board replacement.

An X thread from security researcher IT Guy highlighted that Apple's closest equivalent to GDID is the Directory Services Identifier (DSID). Security researchers at Mysk previously found that DSID travels with App Store analytics data even when analytics sharing is disabled, uniquely linking activity to a specific iCloud account, complete with name and email.

Feature	Microsoft GDID	Apple Equivalent
Identifier Name	Global Device ID	Hardware UUID / DSID
Origin	Assigned by Microsoft’s servers	Generated from the logic board
Account Link	Yes, Microsoft Account	Yes, Apple Account / iCloud
Survives Reinstall	No, new GDID is issued	Yes, Hardware UUID stays the same
Third-Party Access	Not restricted the same way	Isolated from third-party developers
Ad Tracking ID	No direct equivalent	IDFA (resettable since iOS 14.5)

The GDID revelation exposes a massive blind spot in modern digital privacy: consumer-facing toggles are essentially placebo switches when core licensing infrastructure doubles as a behavioral tracking tool. Microsoft spent the first half of 2026 attempting to rebuild user trust following the 2025 backlash over Recall's unencrypted screenshots and forced Copilot integrations. Windows president Pavan Davuluri and Insider Program lead Marcus Ash made public commitments to system quality and transparency.

Yet, the architectural reality of Windows 11 directly contradicts this PR narrative. By intertwining anti-piracy activation tokens with peer-to-peer update sharing (Delivery Optimization) and background syncing (Connected Devices Platform), Microsoft has created an un-toggleable surveillance vector. The fact that neither Microsoft nor Apple publishes a clear law enforcement disclosure policy for these specific hardware-bound identifiers means users are operating in the dark.

Ultimately, fixing File Explorer performance and walking back aggressive AI features are easy wins for Microsoft. But as long as a persistent, undisclosed identifier links browsing activity back to a specific machine without a user-facing reset option, the company's promises of a privacy-respecting operating system remain fundamentally hollow.