An FBI investigation into alleged hacker Peter Stokes revealed Microsoft's ability to track Windows devices and online activity via a "Global Device ID" (GDID). This persistent, device-level identifier uniquely identifies a Windows installation across Microsoft services.

The GDID, detailed in a criminal complaint, allowed investigators to link Stokes' IP address to specific online actions, including accessing the ngrok signup page on May 12, 2025. Microsoft records reportedly showed the GDID accessing various sites hosted by Tzulo, a web hosting provider, during the commission of a hack against a jewelry retailer.

This discovery has prompted concerns about potential surveillance. While a GDID can be reset by reinstalling Windows, it regenerates a new unique ID. Experts suggest that Microsoft could potentially correlate new GDIDs with previous ones using other identifiers like Microsoft account logins or IP addresses, leading some users to explore methods for scrubbing the identifier. The existence of such identifiers raises questions about similar tracking capabilities in other operating systems.