Windscribe deGDID Windows is a new open-source PowerShell tool that aims to remove cached Global Device Identifier, or GDID, keys from a PC and stop Windows from obtaining replacements. The catch is not subtle: Tom’s Hardware reports that its protection mode interferes with Microsoft’s DeviceAdd identity path, which can leave Microsoft apps and account functions unable to connect.
Windscribe, a VPN provider, describes deGDID as a research project. It is aimed at concerns over the server-issued identifier that Windows caches locally. The tool does not erase any identifier records already held on Microsoft’s servers, according to Tom’s Hardware. It changes what the PC retains and whether it can fetch or recreate those local keys.
What does Windscribe deGDID do on Windows?
The script has four reported modes. -Status checks whether a GDID is active without altering the system. -Status -Redact produces diagnostic output with the identifier obscured, intended to make logs safer to share. -Protect removes cached keys and applies the blocking changes. -Unprotect reverses those protection changes.
Under -Protect, deGDID looks for server-issued GDID keys stored in the Windows registry and deletes them. That deletion alone is not durable, Tom’s Hardware reports: Windscribe found in a virtual-machine test that Windows could recreate the keys after a reboot or after contacting Microsoft services.
The second step is what makes the tool more disruptive. The script changes registry permissions and access-control lists, then blocks the internal DeviceAdd endpoint. According to the report, that is intended to stop Windows from fetching and reminting the cached identifiers. It also means Microsoft identity services may no longer recognize the machine as a registered PC for account authentication.
What may stop working after deGDID protection?
Tom’s Hardware tested the script on a Windows 11 PC. Its -Status run showed several cached GDIDs; after -Protect, those entries were removed, and the publication did not see a replacement after restarting the computer.
The same test produced connection errors in some Microsoft apps. Account verification at login.live.com was blocked in every browser tested, while login.microsoftonline.com continued to work. The report says online games and other apps it tried continued operating normally, but that is a narrow test result, not a compatibility guarantee.
- It requires an administrator account.
- It is intended for unmanaged Windows systems.
- It refuses to run on organization-managed or domain-connected machines, Tom’s Hardware reports.
- It cannot remove GDID records that already exist on Microsoft servers.
A VPN does not resolve the same issue by itself, according to Tom’s Hardware’s account of how GDID operates. A VPN tunnels network traffic, while the reported identifier is tied to the device and handled beneath that network layer. For people who rely on Microsoft cloud features or consumer-account sign-in, deGDID’s service breakage may outweigh its local identifier removal.
This story draws on original reporting from Tom's Hardware.
