A Windows device identifier that most users never see has come under fresh scrutiny. US investigators relied on Microsoft records to identify a hacking suspect. The identification was made even after he used a virtual private network (VPN) during the cyberattack.
According to an unsealed criminal complaint, Peter Stokes allegedly hacked an unnamed luxury jewelry retailer in May 2025. Investigators stated that the VPN made it harder to trace the activity through conventional internet records. The investigation took a different turn after a court order directed Microsoft to provide account records linked to a specific Global Device ID, or GDID.
The records reportedly connected the identifier to activity that included a visit to the ngrok sign-up page at a specific time and connections to servers hosted by Tzulo, which investigators linked to the alleged attack. The complaint states that this information, along with timestamps, IP addresses, and tool usage, helped investigators identify the suspect.
The criminal complaint describes the GDID as a persistent identifier assigned to a Windows installation on either a physical computer or a virtual machine. Microsoft uses it across selected services and operating scenarios.
Unique device identifiers are widely used across the technology industry. Companies rely on them for diagnostics, crash reporting, fraud detection, and identifying suspicious login activity. The level of detail investigators were able to obtain through Microsoft records has drawn attention to this case.
Security researchers noted that the identifier appeared capable of linking activity across third-party services without relying on browser cookies. That has prompted fresh discussion about how operating systems track device activity.
The GDID stays with the Windows installation even after routine system updates. Windows does not offer a setting that allows users to turn it off or reset it.
A fresh identifier is created only after a complete reinstallation of Windows. Even then, researchers say anonymity may not be guaranteed if users sign in with the same Microsoft account. Login history, IP addresses, and usage patterns could still help associate a new installation with earlier activity.
Cybersecurity expert Matthew Hickey criticised the system, calling Windows ‘surveillance software’ in response to the case. Microsoft has acknowledged the existence of the identifier on a support page. The company has not issued a public statement on the criminal complaint.
Researchers say Microsoft is unlikely to be the only technology company using persistent device identifiers. Cybersecurity researcher Costin Raiu, speaking on the Three Buddy Problem podcast, suggested Apple could operate similar or even more deeply integrated tracking systems that may survive a system reinstall.
He added that users seeking a high level of anonymity would likely need operating systems such as Linux or FreeBSD combined with privacy tools, including VPNs, Tor and proxy networks.
For most Windows users, the practical impact is limited. The Microsoft records in this case were disclosed through a court order during a criminal investigation. The episode still highlights an important point. A VPN can conceal internet traffic from internet service providers, though it does not prevent an operating system provider from recognising the device running its software.
Also Read: Global VPN Adoption Peaks: One Country Leads With 85.5% Usage