AIBRIEF
degdid.ps1 deletes Microsoft's GDID — a server issued device identifier tied to a Windows install — from a single class of unmanaged, non domain Windows PC, but its own author disclaims any general Microsoft tracking fix.
degdid.ps1 is not a general Microsoft-tracking takedown. It is a narrow completion-gate whose only accepted outcome is the status string StatusProtectedNoRealGdid. The script scrubs one server-issued identifier, Microsoft's GDID, from a personal Windows machine and blocks the local path that mints new GDIDs. The README refuses broader claims: no telemetry, browser-privacy, or court-record coverage.
Eligibility is tight. It runs only on Windows 10 22H2 (build 19045) or Windows 11 build 22000+, in elevated 64-bit PowerShell, on an unmanaged install with one human profile (no domain, Entra, or MDM). Windows 11 25H2 (build 26200) is the fully lab-validated line; other accepted builds warn. Managed systems and multiple loaded users are refused, not guessed at. An Unblock command ships alongside, letting Windows mint a real GDID again if the user reverses the decision.
GDID entered the public record in 2026 via a Northern District of Illinois superseding complaint in United States v. Peter Stokes, an alleged Scattered Spider member extradited from Finland. The filing describes GDID as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device," per Ghacks' summary of the document. Microsoft tied a GDID value to URL, time, and IP data in that one investigation.
The public record does not name the Windows component or network channel that produced that association, and degdid.ps1 disclaims covering it. Hacker News commenters flagged the repo's prose as LLM-flavored and questioned whether the local gate addresses broader tracking. The author's answer, in the README, is the same one the tool enforces: one slot, one machine class, one verdict.