GDID is the persistent Windows ID that helped FBI trace a Scattered Spider hacker despite VPNs. Here's how it works and how to limit it.
  • Zwuzelmaus@feddit.orgEnglish
    4·
    5 days ago

    uniquely identify an installation of a Windows operating system on a device, either a physical device (…) or virtual machine

    Oh. Even VMs.

    What do I need to change in a VM so that this GDID also changes?

    • Trainguyrom@reddthat.comEnglish
      1·
      4 days ago

      Yeah GDID works the same in a VM as it does on hardware. It’s actually easier to see in action on a VM:

      1. Create a Windows desktop VM
      2. Copy the VM
      3. Create a Window server VM and promote it to being an AD Domain in a new forest
      4. Try to join both copied VMs to the AD Domain. You can’t join the second one because the GDID is the same, and you’ll literally have to do a reset to get a new GDID for your VM

      This was the most annoying part of messing with AD in college was running through the windows setup repeatedly because that’s the only way to get more than one client VM for your virtual Windows network

      • Zwuzelmaus@feddit.orgEnglish
        2·
        4 days ago

        Create a Window server VM and promote it to being an AD Domain in a new forest4.Try to join both copied VMs to the AD Domai

        LOL I am very, very far away from knowing how to do such extremely windowsy things.

    • AppleMango@lemmy.worldEnglish
      1·
      5 days ago

      Apparently it requires a Microsoft account to work, so local-only accounts are safe (in the case of patched windows ISOs). But this only disabled GDID and there’s still no guarantee that there aren’t other idenfiers.