ms-private/docs/GDID-SCRIPT-REVIEW.md

# GDID research and supplied-script review

Reviewed 19 September 2026. **Do not incorporate the supplied script unchanged.** It proposes meaningful feature restrictions, but neither its implementation nor the cited research establishes a complete identifier block. No supplied script or repository code was executed on the host.

## Reviewed material

- [gdid-reversal, pinned revision dd4dd5d](https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md).
- [We-running-GDID-back, pinned revision b4daa44](https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md).
- User-supplied `Pasted text.txt`, SHA-256 `0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13`. Line references below refer to that exact attachment. The repositories are research writeups; the pasted script was reviewed separately and its authorship was not inferred.

## What the additional research changes

The sequel reports multiple context-specific device PUIDs, Widgets emitting a SYSTEM-context identifier, and a Store request using the SQMClient MachineID. These are the author's observations, not independently reproduced results from this project. They justify expanding the investigation beyond CDP. [Pinned sequel](https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md).

The author's first writeup corrects its earlier local-account assumption. Its description of CDP as a consumer of an identity value also makes cache deletion a poor basis for a reset claim. [Pinned original](https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md).

Our assessment: a loaded DLL, token-scope entry or function name alone does not prove a particular request executed, identify the exact code path that supplied a value, or establish the backend's retention and reconciliation rules. A client-side ETW trace can expose an HTTPS URL before encryption; that does not mean an ordinary network observer receives the URL in cleartext. Reinstall changing a value does not logically exclude hardware as one of several provisioning inputs. These distinctions must survive into the blog.

## Problems in the pasted script

| Finding | Evidence in attachment | Consequence and required correction |
| --- | --- | --- |
| Status looks for the wrong marker | Markers at lines 24–25 use `GDID-BLOCKER`; line 120 searches `GDID-BLOCK START` | A block written by the script is reported absent. Compare exact marker constants and check the entries themselves. |
| Success can be printed after failure | `Continue` at line 19; native `sc.exe` calls at 49–64; unconditional success at 132 and 138 | Native exit codes are not checked. Fail on errors, wait for service state, read back configuration and report partial results. |
| Activity policies are not restored | Values overwritten at 68; removed at 72; no prior-value journal | Existing policy, including an existing deny, can be lost. Record existence, registry type and original value before writing. Refuse externally changed values on rollback. |
| Per-user service template is not correctly inventoried | `Get-Service CDPUserSvc` at 44; suffixed instances stopped at 49 | The template and generated instances need separate handling. Microsoft documents the template in the registry. Verify persistence across sign-out/sign-in and reboot. |
| Service recovery loses state | Only `StartType` recorded; fallback `demand`; unconditional start at 64 | Delayed-start metadata and previous running state are not preserved. Do not guess defaults or start a previously stopped service. |
| Hosts file is rewritten without a transaction | Lines 76–97 | A one-time backup is created but not used by enable. Preserve original bytes/encoding, validate balanced unique markers, use atomic replacement and detect concurrent edits. Do not restore an old whole-file backup over newer user edits. |
| Malformed markers can remove unrelated entries | The loop at 79–84 and 90–95 stays inside until an end marker | A missing end marker discards the remainder. Reject malformed input before writing anything. |
| ASCII conversion changes existing content | Lines 86 and 96 | Non-ASCII comments are changed; existing encoding is not preserved. This is independently reproducible in memory. |
| Cache removal is irreversible and has ambiguous user scope | Lines 100–105 use the elevated process's `LOCALAPPDATA` | Elevation with a different administrator account targets that account's profile. No cache backup exists; regeneration is not restoration. Make deletion a separate explicit operation with resolved path and reparse-point checks. |
| Hosts entries are not a complete egress boundary | Domain list at 30–38 | Exact names do not cover all subdomains, cached destinations, direct IP or resolver bypass. Neither marker presence nor DNS cache flushing verifies traffic suppression. |
| Notification blocking has collateral effects | WNS/notify names in the domain list | WNS supports app notifications and management scenarios. Keep it out of the default denylist pending measured need and compatibility tests. |
| No real read-only status entry point | Elevation and directory creation happen before mode dispatch | Status should not request administrator rights or create state. Separate audit from mutation and handle elevation cancellation explicitly. |

Microsoft's [per-user services documentation](https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows) describes templates and generated instances. Its [Windows endpoint documentation](https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints) describes WNS functionality and the consequences of blocking it. Neither page proves that disabling those components suppresses every device identifier.

## Verification performed

PowerShell parsed the attachment without executing it. Three isolated in-memory probes confirmed: the real marker fails the script's search pattern; an unmatched start marker drops trailing synthetic entries; ASCII conversion changes a synthetic Unicode comment. No service, policy, hosts file, cache or network setting was modified. Results are in `reports/upstream-review/pasted-script-static-probes.json`.

## Integration decision

1. Keep the current supported-policy engine as the default. Add an experimental CDP investigation item, not a button labelled “GDID disabled.” Prefer a documented policy deployment route when available.
2. Separate CDP restrictions, Activity History retention, Widgets, notification delivery and Store behavior. Each needs its own applicability, side effects, evidence and restoration record.
3. Exclude cache deletion from “disable.” If offered, show irreversible data loss and identify the exact user profile before deletion.
4. Keep Windows Update, Store security updates/revocation, Defender, reputation protection and certificate maintenance in the acceptance tests. Do not disable `wlidsvc`, `WpnService` or all Microsoft domains simply to make an identifier disappear from one trace.
5. Reproduce claims in disposable Windows 11 and eligible Windows 10 environments. Record OS build, app versions and account mode. Observe CDP and Widgets separately, then repeat after one change at a time and after reboot/sign-in.
6. Capture only what the lab needs. Raw ETW/HTTP details may include tokens, query strings, account names and device IDs. Use disposable accounts; redact at source for reports and keep raw evidence access-restricted. Do not enumerate or publish identifiers from this development host.
7. Publish a matrix of observed effects and residual connections. “No event seen in this workload” is a bounded observation, not proof of backend unlinkability.