Global Device Identifier, a Server-assigned Installation Identifier That Windows Can Acquire Even When the Interactive User Has Only a Local

The repository documents the wider GDID lifecycle. The shipped degdid.ps1 has a narrower operational objective: On a supported Windows target, remove real server-issued GDID state from the known local stores and keep the DeviceAdd path continuously blocked. That is a GDID completion gate.

It is not a general telemetry, browser-privacy, or court-record-channel suppression claim. GDID is a server-assigned 64-bit Device PUID that Windows can mint through Microsoft's DeviceAdd infrastructure and retain across several local identity stores. A local Windows account does not prevent that machine-level mint.

Court reporting in 2026 established that Microsoft held a GDID-to-URL/time/IP association in one investigation. The public record does not identify the Windows component or network channel responsible; this tool makes no claim to block that unknown channel. The mutation path is designed for an unmanaged personal Windows installation with one loaded human profile: Windows 11 25H2/build 26200 is the fully lab-validated line.

Other accepted builds warn. Managed systems, ambiguous users, and multiple loaded human profiles are refused instead of guessed at. Status can still inspect unsupported systems.

See the usage guide for the complete eligibility rules. ProtectedNoRealGdid is the only complete result. Re-run Status after major Windows, firewall, security-product, or hosts-file changes.

Unblock allows Windows to mint a real GDID again. See the usage and CLI reference for every command, verdict, exit code, DryRun behavior, pre-first-online setup, and recovery details. The network gate is applied before identity mutation.

If a required check fails, the script stops instead of continuing with a partial protection state. Canonical protection uses Wipe. Decoy mode exists for research but is not considered a clean completion state.

Technical mutation details live in countermeasures.md and surfaces.md. ProtectedNoRealGdid means the supported environment was readable, no real-shaped PUID remained in the known inventory, and the DeviceAdd gate verified.