Abstract: Embodiments described herein involve building upon a hardware identity of a device and using it to match and detect hardware changes on the device and to identify potential identity mismatches. At initialization, the device also generates a globally-unique identification (GUID) marker that persists across operating system (OS) reinstallations. On the device, there is a periodic routine that detects hardware mismatches by comparing the current identity of the device with a cached version, along with the GUID. Once a change is detected, the device sends a request to a service that stores a hint (e.g., the GUID) for a later secure restoration attempt. A remote service (e.g., a cloud-based service) then attempts to restore the hardware identity of the device upon next check-in via a secure transmission of the updated identity, as well as resolving conflicts in a device record maintained by the remote service.