The article explains Microsoft's GDID, a server‑assigned 64‑bit Device PUID that Windows can mint via Device Add even when the user only has a local account. The degdid.ps1 script removes real GDID state from local stores and blocks the Device Add path, acting as a GDID completion gate rather than a general telemetry block.

It targets unmanaged personal Windows installations with a single loaded human profile: Windows 10 22H2/build 19045, Windows 11 build 22000 or newer, no domain, Entra, workplace, or MDM enrollment, and an elevated 64‑bit PowerShell session. The script offers -Status, -Protect, and -Unblock commands. After Protect, a status of "Protected No Real Gdid" indicates no real GDID remains.

Protect applies dual‑stack hosts blocks, refreshes firewall defenses, clears known GDID copies from target user, .DEFAULT, and SYSTEM, and verifies the network gate before mutation. If any check fails, the script stops instead of delivering a partial state.

Lab evidence on Windows bilo 11 25H2/build 26200 shows over 33 hours of protection, successful re‑mint after Unblock, and field runs that stayed protected through sign‑in/out, sleep/resume, reboot, and 18 hours. Expected impact includes breaking MSA sign‑in, Store, Xbox, OneDrive, Phone Link, and CDP graph features, while core desktop access remains functional.