Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing
Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing
微软确认 Windows 存在无法禁用的 GDID 设备标识符，相关信息已记录在 FBI 案件文件中
Microsoft has publicly acknowledged the existence of the Global Device Identifier (GDID), a device-specific ID assigned to Windows installations, in a federal complaint filed by US prosecutors against an alleged member of the Scattered Spider hacking group. 微软在针对黑客组织“Scattered Spider”一名涉案成员的联邦诉讼中，公开承认了“全局设备标识符”（Global Device Identifier，简称 GDID）的存在。这是一种分配给 Windows 安装实例的设备特定 ID。
The ID is generated when Windows is set up with a Microsoft Account, persists through Windows updates, and cannot be disabled without affecting Windows activation and Microsoft Store apps. 该 ID 在用户使用微软账户设置 Windows 时生成，在 Windows 更新过程中保持不变，且无法在不影响 Windows 激活和微软商店应用的情况下禁用。
Microsoft briefly mentioned GDID in the Azure Monitor documentation, describing it only as “an identifier used by Microsoft internally.” The complaint cites a Microsoft representative describing GDID as “a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device such as a mobile phone or laptop or a virtual machine, across certain Microsoft services and scenarios.” 微软曾在 Azure Monitor 文档中简要提及 GDID，仅将其描述为“微软内部使用的标识符”。此次诉讼文件引用了一位微软代表的描述，称 GDID 是“一种持久的、设备级别的标识符，旨在跨特定微软服务和场景，唯一地识别设备上的 Windows 操作系统安装实例，无论是手机、笔记本电脑等物理设备，还是虚拟机。”
What the Windows Global Device Identifier Is and How the FBI Used It
什么是 Windows 全局设备标识符以及 FBI 如何使用它
The Global Device Identifier (GDID) is a permanent ID assigned when Windows provisions against a Microsoft Account. It is generated by a chain of Windows services. 全局设备标识符（GDID）是在 Windows 通过微软账户进行配置时分配的永久 ID。它由一系列 Windows 服务链生成。
The wlidsvc service requests a Device PUID from login.live.com, which is then registered into Microsoft’s Device Directory Service by the Connected Devices Platform. wlidsvc 服务会向 login.live.com 请求一个设备 PUID，随后由“连接设备平台”（Connected Devices Platform）将其注册到微软的设备目录服务中。
Delivery Optimization reports the GDID back to Microsoft when the PC shares or downloads updates. This identifier is stored in the Windows registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties and formatted with a lowercase “g” prefix followed by a decimal number.
当电脑共享或下载更新时，“传递优化”（Delivery Optimization）会将 GDID 上报给微软。该标识符存储在 Windows 注册表的 HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties 下，格式为小写字母“g”后跟一个十进制数字。
It is reported to Microsoft servers and remains persistent across Windows updates, but it is not retained after a clean reinstall. Microsoft has acknowledged that one user can have multiple GDIDs linked through their account, OneDrive, and activation history. 它会被上报至微软服务器，并在 Windows 更新期间保持不变，但在执行全新重装系统后不会保留。微软承认，一个用户可以通过其账户、OneDrive 和激活历史记录关联多个 GDID。
The FBI used the GDID to track Peter Stokes, alleged member of Scattered Spider, across VPN connections, proxy servers, and through four countries over roughly eight months. FBI 利用 GDID 追踪了 Scattered Spider 的涉案成员 Peter Stokes，追踪范围跨越了 VPN 连接、代理服务器，并在约八个月的时间里横跨四个国家。
According to the complaint, the GDID g:6755467234350028 was recorded visiting the ngrok signup page at the same time an account used in the attack was created via a Tzulo VPN proxy. Three hours later, the same GDID accessed a victim retailer’s website through the same proxy.
根据诉讼文件，GDID g:6755467234350028 在攻击中使用的账户通过 Tzulo VPN 代理创建的同时，被记录到访问了 ngrok 注册页面。三小时后，同一个 GDID 通过相同的代理访问了受害零售商的网站。
The device was cross-referenced with IP addresses linked to Stokes’s accounts on Snapchat, Facebook, Apple, and Ubisoft across Estonia, New York, Thailand, and other locations. Stokes’s public Snapchat photos matched hotel bookings, locations, and travel timelines associated with the GDID. 该设备与 Stokes 在 Snapchat、Facebook、Apple 和 Ubisoft 账户关联的 IP 地址进行了交叉比对，涉及爱沙尼亚、纽约、泰国等地。Stokes 公开的 Snapchat 照片与该 GDID 关联的酒店预订、地点和旅行时间线相吻合。
The persistent nature of the GDID across VPN sessions proved a key investigative asset. While VPN IP addresses change frequently, the underlying Windows installation continued reporting the same identifier, aiding investigators in their tracking efforts. GDID 在 VPN 会话中的持久性成为了关键的调查资产。尽管 VPN 的 IP 地址频繁变动，但底层的 Windows 安装实例始终上报相同的标识符，从而协助调查人员完成了追踪工作。
Why Privacy Researchers Are Concerned and What Users Can Do
为什么隐私研究人员感到担忧以及用户可以做什么
Multiple security researchers have raised concerns about the visibility and control users have over GDID: 多位安全研究人员对用户在 GDID 方面的可见性和控制权提出了担忧：
- There is no consent screen when GDID is assigned. Apple’s advertising identifier requires an App Tracking Transparency prompt with a visible reset. Android provides similar controls. GDID has neither. 分配 GDID 时没有同意界面。 苹果的广告标识符要求通过“App 跟踪透明度”提示，并提供可见的重置选项。安卓也提供类似的控制。而 GDID 两者皆无。
- Activation dependence. Massgrave, the group behind Microsoft Activation Scripts, has noted that Windows setup sends hardware info to Microsoft and receives identifiers back that are later used for Store access and licensing. Blocking GDID assignment breaks both activation and UWP apps. 激活依赖性。 微软激活脚本（MAS）背后的组织 Massgrave 指出，Windows 设置会将硬件信息发送给微软，并接收回标识符，这些标识符随后用于商店访问和许可。阻止 GDID 分配会破坏激活和 UWP 应用。
- Reinstalling Windows produces a new GDID, but signing back into the same Microsoft Account gives Microsoft a clear path to link the new identifier to previous activity. 重装 Windows 会产生新的 GDID，但重新登录同一个微软账户，微软就能清晰地将新标识符与之前的活动关联起来。
- Microsoft’s public documentation of the identifier consists of one sentence in an Azure Monitor reference table for enterprise IT administrators. 微软关于该标识符的公开文档仅在 Azure Monitor 的企业 IT 管理员参考表中提到了一句话。
Security researcher Matthew Hickey has characterized Windows as “surveillance software” in response to the case. Costin Raiu asked on the Three Buddy Problem podcast how much similar functionality exists on other platforms. 安全研究人员 Matthew Hickey 在回应此案时将 Windows 称为“监控软件”。Costin Raiu 在《Three Buddy Problem》播客中提问，其他平台上是否存在类似的功能。
Users concerned about GDID have limited direct options because the identifier cannot be turned off without breaking core Windows functionality. Practical steps that reduce related tracking include: 担心 GDID 的用户选择有限，因为如果不破坏 Windows 的核心功能，就无法关闭该标识符。减少相关追踪的实用步骤包括：
- Use a local account instead of a Microsoft Account when possible. Windows 11 has made this harder in recent versions, but the option is still available during setup for users who know how to reach it. 尽可能使用本地账户而非微软账户。Windows 11 在近期版本中增加了难度，但对于知道如何操作的用户，在设置过程中该选项仍然可用。
- Turn off optional diagnostic data through Settings, Privacy and security, Diagnostics and feedback. 通过“设置” > “隐私和安全性” > “诊断和反馈”关闭可选诊断数据。
- Disable personalized ads and launch tracking under Privacy and security, Recommendations and offers. 在“隐私和安全性” > “推荐和优惠”下禁用个性化广告和启动跟踪。
- Turn off Cloud Content Search under Privacy and security, Search, to stop local searches from sending data to Bing. 在“隐私和安全性” > “搜索”下关闭“云内容搜索”，以阻止本地搜索向 Bing 发送数据。
- Review and disable Activity History and other telemetry options in Privacy and security settings. 在隐私和安全设置中检查并禁用“活动历史记录”和其他遥测选项。
For journalism, activism, or domestic abuse situations where identifier persistence poses a threat, use Linux routed through Tor rather than relying on a commercial VPN with a Windows PC. Users who reinstall Windows to obtain a new GDID should be aware that signing back into the same Microsoft Account provides Microsoft with data linking the new identifier to previous activity. 对于新闻工作、社会活动或家庭暴力等标识符持久性可能构成威胁的情况，建议使用通过 Tor 路由的 Linux 系统，而不是依赖运行 Windows 的商业 VPN。重装 Windows 以获取新 GDID 的用户应注意，重新登录同一个微软账户会向微软提供将新标识符与之前活动关联的数据。
What GDID Means for Windows Users and How Widely It’s Deployed
GDID 对 Windows 用户意味着什么以及它的部署范围
For the approximately 1.6 billion Windows users worldwide, GDID has been operating quietly in the background without any public disclosure or user controls. The recent complaint revealed the existence of this identifier, but Microsoft has not committed to providing user-facing controls or documentation for regular users. 对于全球约 16 亿 Windows 用户而言，GDID 一直在后台静默运行，没有任何公开披露或用户控制选项。最近的诉讼揭示了该标识符的存在，但微软尚未承诺为普通用户提供面向用户的控制选项或文档。
Users concerned about device-level tracking should be aware that the identifier is attached to the account, not the device, meaning reinstalling the OS does not break the link. 担心设备级追踪的用户应意识到，该标识符是绑定在账户而非设备上的，这意味着重装操作系统并不能切断这种关联。
Most major operating systems maintain some form of persistent device identity for purposes like licensing and security checks, but Windows differs from platforms like Apple and Google by not offering visible controls. 大多数主流操作系统都会出于许可和安全检查等目的维护某种形式的持久设备标识，但 Windows 与苹果和谷歌等平台的不同之处在于，它不提供可见的控制选项。