Windows device ID tracking is more powerful than most users realise — and the arrest of an alleged Scattered Spider member just made that undeniably clear. When the FBI needed to tie a suspect’s online activity to a physical machine, Microsoft handed over data from a persistent identifier called the GDID (Global Device Identifier), linking the Windows installation to accounts, locations, and actions even when the suspect was using a VPN. For everyday home users, that might sound reassuring. For enterprise IT teams, it raises urgent questions about data governance, employee privacy, and what Microsoft actually holds about every Windows device on your network.
What Is the GDID and How Does Windows Device Tracking Work?
The GDID — Global Device Identifier — is a persistent telemetry token embedded in Windows installations. Unlike a simple IP address or browser cookie, GDID is tied to the Windows device itself, meaning it survives reboots, browser wipes, and even VPN tunnels. Every time a Windows machine phones home to Microsoft’s servers for updates, crash reports, or diagnostic data, that GDID travels along with the payload. Microsoft’s telemetry infrastructure correlates it with account sign-ins, hardware fingerprints, and usage patterns over time.
The Scattered Spider case made this concrete. According to reporting by PCMag, the FBI obtained a legal order compelling Microsoft to produce GDID-linked records for a suspect later identified as Peter Stokes — a 19-year-old US-Estonian national arrested in Helsinki while allegedly connected to a ransomware extortion group that hit over 120 networks. The GDID data tied his Windows 11 device to a trail of online accounts and physical locations that VPN usage could not obscure.
This is Windows telemetry tracking in practice: passive, persistent, and legally accessible.
The Scattered Spider Arrest: A Timeline of GDID Evidence
Scattered Spider (also tracked as UNC3944) is a financially motivated threat group responsible for high-profile breaches at major organisations including MGM Resorts and Caesars Entertainment, causing hundreds of millions of dollars in damages. In 2025, the FBI and UK partners secured the arrest of a key alleged member, with Windows device ID tracking playing a central role in the evidence chain.
-
Initial breach activity: The suspect allegedly used compromised credentials and social engineering to access victim networks.
-
VPN concealment attempted: Typical OPSEC measures including VPN services were used to mask IP addresses.
-
GDID correlation: Microsoft’s telemetry linked the Windows device’s unique GDID to multiple online identities and sign-in events across time.
-
Legal compulsion: The FBI obtained a court order; Microsoft cooperated and produced the relevant records.
-
Arrest in Helsinki: Stokes was detained at an airport before he could board a flight, reportedly based in part on the device-linked evidence trail.
The key takeaway for security professionals: GDID-based Windows device tracking rendered conventional anonymisation techniques insufficient. This is not a theoretical risk — it is a documented law-enforcement outcome.
What Data Does Windows Telemetry Actually Send?
Microsoft’s telemetry operates across four configurable levels — Security, Basic, Enhanced, and Full — though consumer editions of Windows 11 have effectively retired the ability to drop below Basic. According to Microsoft’s own Configure Windows diagnostic data documentation, even the minimum “Required diagnostic data” level transmits device-specific identifiers, hardware configuration details, software inventory, performance metrics, and connectivity information.
At higher levels, telemetry includes browsing activity within Microsoft products, typed text samples (for improving input), and application crash dumps. The GDID sits at the core of this: it is the thread that stitches all these data streams into a coherent per-device profile on Microsoft’s back end.
-
Required diagnostic data: Device ID, hardware specs, OS version, basic crash reports
-
Optional diagnostic data: Browsing data in Edge, app usage details, text input samples
-
Windows Error Reporting: Application crash dumps that may contain memory snapshots
-
Connected User Experiences: Personalisation data linked to your Microsoft account
GDID Windows Identifier: Enterprise Privacy Implications
GDID Windows identifier exposure is not just a concern for cybercriminals trying to stay anonymous — it has direct implications for any organisation running Windows at scale. Consider these scenarios:
Employee monitoring risk: If a disgruntled employee uses a company laptop to access personal accounts, the GDID could theoretically link corporate device telemetry to their personal online activity — data that could surface in litigation or regulatory investigations.
Cross-border data transfers: Microsoft routes telemetry through US-based infrastructure. For EU-based organisations subject to GDPR, this raises questions about lawful data transfer grounds for identifiable device-level data flowing outside the EEA.
Insider threat investigations: While GDID tracking has proven effective against external threat actors like Scattered Spider, the same mechanism could be used against employees in ways that conflict with workplace privacy laws in jurisdictions including Germany, France, and the Netherlands.
Third-party legal exposure: A legal order served on Microsoft in any jurisdiction where Microsoft operates could compel production of GDID-linked records about your devices, without direct notice to your organisation.
How to Manage Windows Telemetry Tracking in an Enterprise Environment
Windows telemetry tracking can be significantly curtailed through Group Policy, the Registry, and endpoint management platforms — though it cannot be eliminated entirely on standard Windows editions. Here is what enterprise administrators can do today.
Group Policy Controls
On Windows 11 Enterprise and Education editions, navigate to Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds. The Allow Diagnostic Data policy lets you enforce the minimum telemetry level across all managed devices. Setting the value to 0 – Security (available only on Enterprise/Education) limits transmission to the narrowest possible set of security-related data. After applying the policy, run gpupdate /force to push it immediately.
Windows LTSC: The Low-Telemetry Option
For environments with strict data-governance requirements, Windows 10 LTSC (Long-Term Servicing Channel) is the edition with the most aggressive telemetry reduction options. It ships without the Microsoft Store, Cortana, and several consumer-facing connected services, and it supports the Security telemetry level on all domain-joined installations. Windows 11 IoT Enterprise LTSC offers similar controls for Windows 11 environments. If your security policy demands the lowest possible GDID Windows identifier exposure, LTSC editions are worth evaluating.
Microsoft Endpoint Manager / Intune Policies
Organisations using Microsoft Intune can deploy device configuration profiles targeting the Reporting and telemetry category to enforce diagnostic data levels fleet-wide, without relying on per-machine Group Policy. This approach scales more reliably across hybrid and remote workforces than manual GPO application.
Network-Level Blocking
Firewall and DNS-based blocking of Microsoft telemetry endpoints (published in Microsoft’s own documentation) provides a secondary layer of control. Note that aggressive endpoint blocking can interfere with Windows Update, Windows Defender signature delivery, and Microsoft 365 connectivity — test thoroughly before deploying at scale.
Does Reducing Telemetry Weaken Your Windows Security Posture?
This is the genuine tension: Microsoft argues — with some merit — that telemetry data feeds its threat intelligence platform, which analyses over 24 trillion security signals per day to identify emerging threats. Cutting telemetry may marginally reduce the fidelity of cloud-based protection in Windows Defender. The practical impact on most enterprise environments is modest, since Defender’s core signature-based and behavioural protections operate locally and do not depend on telemetry being enabled at maximum levels. The tradeoff is real, but manageable with compensating controls.
What This Means for Your Windows Licence Strategy
The Scattered Spider case is a reminder that the edition of Windows you deploy matters beyond feature sets and price points. Enterprise and Education editions give administrators control over telemetry that Pro and Home editions do not. If your organisation is currently running Windows 11 Pro on managed devices and has not reviewed its telemetry posture, now is a practical moment to do so.
Shop Key Online supplies genuine Windows 11 Pro licences — including Windows 11 Pro Retail keys from €17.95 — with instant email delivery and a 100% money-back guarantee if activation fails. For teams needing to roll out multiple seats, the Windows 11 Pro OEM licence at €15.95 per device offers a cost-efficient path to putting properly licensed, patchable, security-updated Windows on every machine. Running genuine, fully activated Windows is the baseline for any coherent enterprise security policy — unlicensed or activation-hacked installations often disable telemetry controls in ways that create different, unpredictable security gaps.
Practical Steps for IT Administrators Right Now
-
Audit your current telemetry level — Use the Settings app (Privacy & security > Diagnostics & feedback) or Group Policy reporting to confirm what your devices are sending today.
-
Enforce minimum telemetry via GPO or Intune — Don’t rely on device defaults; push policy centrally.
-
Review your edition mix — If significant numbers of devices run Home or Pro, evaluate whether Enterprise editions’ additional controls justify the cost difference for your risk profile.
-
Document your legal basis — For GDPR-covered organisations, record your lawful basis for any telemetry flows and review your Microsoft DPA (Data Processing Agreement) terms.
-
Evaluate LTSC for sensitive roles — Devices used by executives, legal teams, or finance may warrant the lower attack surface of an LTSC edition.
-
Monitor Microsoft’s telemetry endpoint list — Microsoft publishes and updates the list of telemetry domains; subscribe to change notifications to keep firewall rules current.
Frequently Asked Questions
What exactly is the Windows GDID?
The GDID (Global Device Identifier) is a persistent unique identifier assigned to a Windows installation. It is used by Microsoft’s telemetry infrastructure to associate diagnostic data, sign-in events, and usage information with a specific device over time. Unlike an IP address, it does not change when you connect via a different network or VPN.
Can a VPN prevent Windows device ID tracking?
No — and the Scattered Spider case proves this. A VPN masks your IP address at the network layer, but GDID-linked telemetry is transmitted from the Windows device itself to Microsoft’s servers as part of normal OS operation. Microsoft holds the GDID-to-device mapping on its back end, independently of which IP address the device was using at the time.
Is Windows telemetry tracking legal?
In most jurisdictions, yes — Microsoft discloses data collection in its Privacy Statement and Service Agreement, and users consent during Windows setup. The GDPR creates additional obligations for organisations processing employee device data, requiring a documented lawful basis and appropriate safeguards for data flowing outside the EEA. Whether any specific telemetry configuration is compliant depends on your jurisdiction and sector.
Does disabling telemetry stop the GDID from being tracked?
Minimising telemetry reduces the volume and granularity of data Microsoft receives, but Windows still requires some level of connectivity to Microsoft’s infrastructure for licensing validation, Windows Defender updates, and Windows Update. The GDID may still be transmitted in those contexts. The Security telemetry level on Enterprise editions offers the most restrictive configuration available on standard Windows.
Which Windows edition gives the best telemetry controls?
Windows 11 Enterprise and Windows 11 IoT Enterprise LTSC offer the most granular telemetry controls, including the ability to set diagnostic data to the minimum Security level. Windows 11 Pro supports Group Policy but cannot reach the same minimum floor. Windows 11 Home offers only settings-based controls with no Group Policy access.
Should enterprises be worried about the Scattered Spider GDID precedent?
Enterprises should treat it as a prompt to review their telemetry policy rather than a cause for alarm. The GDID mechanism was used lawfully in a criminal investigation — it is not a vulnerability that attackers can exploit. The legitimate concern is around data governance: knowing what Microsoft holds about your devices, under what legal framework, and what scenarios could compel its disclosure to third parties, including law enforcement.
