Device and operating-system identity
Your device carries an identity tag.
A Global Device Identifier is not a probabilistic fingerprint. It is an assigned value that lets a platform recognize a Windows installation, a machine, or an account across a defined set of services. The important questions are what it identifies, who receives it, and what survives a reset.
- Category
- Assigned identifier
- Browser-readable
- Usually no
- Cookie-based
- No
- Always hardware-bound
- No
Overview
What is a Global Device ID?
In Microsoft’s Windows ecosystem, a Global Device Identifier (GDID) is a persistent value used across certain Microsoft services and scenarios. A 2026 federal complaint records Microsoft’s explanation that the cited value survived Windows updates, while a Windows reinstall produced a new GDID. Independent Windows research adds an important complication: one installation can hold multiple device PUIDs for different security contexts, and Microsoft client code can reconcile related device identities.
“Global device ID” is not a universal industry category with identical behavior on every platform. The broader category is platform-assigned persistent identifiers. Some identify an OS or security context, some identify physical or virtual hardware, and some identify an account.
Documentation note: Microsoft exposesGlobalDeviceId in scattered schema and troubleshooting references, including the linked UCDOStatus field, but we could not find a dedicated official explanation of what GDID is, where every variant is used, or its complete lifecycle.Similar device IDs
Different OSes have different implementations.
These identifiers can all make a device or user recognizable, but they are issued at different layers. Windows GDIDs and device PUIDs can vary by security context, Apple’s Hardware UUID names a machine identity, and DSID belongs to account infrastructure. Before calling any of them permanent, ask what object it identifies, which services can see it, and what event changes it.
Windows GDID / device PUID
- Issued by
- Microsoft identity infrastructure
- Persists through
- Often across Windows updates
- Reset boundary
- Reprovisioning or Windows reinstall
- Documented visibility
- Windows services and Microsoft records
Apple Hardware UUID
- Issued by
- Hardware / platform identity
- Persists through
- Outside the OS volume
- Reset boundary
- Hardware or VM identity changes
- Documented visibility
- macOS, native software, submitted services
Apple DSID
- Issued by
- Apple account infrastructure
- Persists through
- With the account
- Reset boundary
- Account context changes
- Documented visibility
- Apple services; derived values over BLE
Microsoft PUID
- Issued by
- Microsoft identity services
- Persists through
- Depends on PUID class and provisioning
- Reset boundary
- Account, context, or reprovisioning changes
- Documented visibility
- Windows identity stores and scoped Microsoft services
The PUID findings above come from independent registry, traffic, and binary analysis, not a complete Microsoft specification. Hardware UUID behavior after repair or virtualization changes is also implementation-dependent. Apple documents the value and its use in device registration, but does not publish one complete consumer-facing lifecycle specification for every Mac and VM configuration.
Collection paths
A website does not automatically receive these values.
A web page cannot normally ask the browser for a raw GDID, Hardware UUID, PUID, or DSID. But that does not isolate browser activity from device identity. A website or app event can carry a browser fingerprint, URL, account, IP address, and timestamp while a separate Windows or native-service telemetry event carries a persistent device identifier. Provider systems can join those records through shared times, accounts, network addresses, service sessions, or other backend associations.
This is the practical cyberforensic path: individually limited events become one identity graph. The persistent identifier does not need to appear in browser JavaScript if internal telemetry and fingerprinted activity can be correlated later.
GDIDWindows serviceMicrosoftUUIDSystem / native appchosen serviceDSIDApple AccountApple serviceInteractive reset map
What actually changes the identifier?
Select an action. The map separates a network or browser reset from an operating-system, hardware, or account reset.
A VPN changes the network route and public IP. It does not rewrite identifiers held by the operating system, hardware, or platform account.
Cookie storage belongs to the browser. These identifiers exist below or outside that storage boundary.
The federal complaint describes GDID as remaining consistent across Windows operating-system updates. Apple identifiers are outside this Windows action.
The complaint says a Windows reinstall receives a new GDID. That does not erase records already held by a provider.
Replacing a Mac logic board or changing a virtual machine identity can produce a different Hardware UUID. The exact result depends on the repair or virtualization path.
DSID is account-linked. A different account changes that account identity, while the machine Hardware UUID remains separate.
This is an evidence map, not a detector. This page cannot read the three identifiers it describes.
Apple identifiers
Hardware UUID and DSID are not one “Apple device ID.”
The Hardware UUID is a machine identifier visible in macOS System Information and available through I/O Kit. Apple’s developer documentation uses that value when registering Macs for development distribution. Local licensing systems and native software may also choose to read it.
A DSID (Destination Signaling Identifier) belongs to the Apple Account layer. Apple documents one concrete use in Instant Hotspot: devices derive an identifier from the account-linked DSID, put the derived value in a Bluetooth Low Energy advertisement, and rotate that advertised identifier periodically.
4F8C29A1-…-A19Dsystem · native software · registrationaccount-linked valueApple service infrastructureDocumented case
A device ID became the spine of a correlation chain.
In a 2026 superseding federal complaint against Peter Stokes, investigators described Microsoft records that connected one GDID to web activity, proxy IP addresses, and the creation of an ngrok account. Other provider and travel records were then used to argue that the device belonged to Stokes.
- 01Microsoft recordOne persistent GDID
The filing identifies a specific
g:…value for one Windows installation. - 02Timed activityngrok signup page
Microsoft records allegedly placed the device on the signup URL when the account was created.
- 03Network overlapProxy and residential IPs
The GDID record was compared with proxy activity and IPs used by named accounts.
- 04Identity evidenceAccounts, travel, images
Social, Apple, State Department, hotel, and other records added human context.
A persistent identifier can organize provider-held events into a long-lived record and become a search or correlation key.
That every Windows page visit is always recorded with GDID, or that a public website can read GDID directly.
The filing contains allegations and an investigator’s account of provider records. It is not, by itself, a finding of guilt.
Provider records
An identifier can become a query key.
Providers do not need to know a person’s name at collection time for records to become identifying later. A durable value can group events first; account records, IP history, billing data, travel, or another provider can supply the identity later.
Microsoft says it requires valid legal demand—such as a subpoena or court order—for non-content data and a warrant or equivalent for content. Apple’s U.S. guidelines make similar distinctions and describe device identifiers as search parameters for several record types. The exact standard depends on jurisdiction, provider, and requested data.
Controls by boundary
A browser control cannot rewrite an OS account identifier.
Start by naming the observer. Then choose a control that actually reaches that layer.
| Control | What it changes | What it does not change |
|---|---|---|
| VPN | Public IP and network route | GDID, Hardware UUID, DSID, platform accounts |
| Private browsing | Local browser session and storage | OS services, hardware identity, account identity |
| Reduce optional diagnostics | Some Windows telemetry categories | All required service data or every identifier-bearing flow |
| Separate OS or VM | Installation and machine boundary | Account linkage if the same account is reused |
| Separate platform account | Account-scoped linkage | Machine, network, or browser identity |
| Anti-fingerprinting | Page-visible browser signals | Native telemetry and vendor-service identifiers |
Inspect before guessing
Windows Diagnostic Data Viewer can show events the device sends to Microsoft. It is visibility into a larger system, not proof it exposes every backend association.
Minimize optional collection
Review diagnostic settings and platform accounts. Optional data can include browsing and device activity; required data still exists.
Separate high-risk work
If vendor correlation matters, use a separately provisioned environment and do not sign it into personal platform accounts.
Do not promise deletion
Rotating a local value does not erase provider history. Unofficial removal tools can break sign-in, update, or licensing behavior.
Continue reading