wtf is gdid-guard?

GDID-Guard is a Windows privacy tool for checking and reducing exposure from the Global Device Identifier system, an identifier Windows assigns when a device signs into a Microsoft Account and registers into Microsoft's device graph through a background feature called the Connected Devices Platform. It falls into the same category as tools like O&O ShutUp10++, but focuses specifically on this one identifier chain rather than telemetry in general. The main script offers a read only audit mode that reports the current state of the relevant service, settings, identity cache, and firewall rules without changing anything. It can also save a timestamped snapshot of that state to compare against later, and a compare mode that shows exactly what changed between two snapshots. A separate remediation mode, which requires administrator rights, applies fixes you choose individually: disabling the Connected Devices Platform, turning off Activity History, clearing the local identity cache, or blocking known endpoints at the firewall level. Before making changes it creates a Windows System Restore point and automatically saves a snapshot of the state beforehand, and every action gets written to a log file. A companion restore script can undo each of those changes individually or all at once, using the saved pre change snapshot where possible. The project also ships a plain text list of known device graph hostnames that can be dropped into tools like Pi-hole or AdGuard as a custom blocklist. The README is upfront about the limits of the approach. Disabling the Connected Devices Platform trades away features like cross device Activity History sync and parts of Phone Link. If the device stays signed into a Microsoft Account, Windows can still assign a new identifier the next time it registers with the device graph, since the identifier is issued by Microsoft's servers rather than only stored in local settings. IP based firewall rules can also go stale if Microsoft changes the addresses behind the relevant hostnames, so the author suggests DNS level blocking as a more durable option. The tool requires Windows 10 or 11 and PowerShell 5.1 or newer, with administrator privileges needed for the remediation and restore scripts.