This error occurs on Windows when Git cannot access files because antivirus software is actively scanning or quarantining them. The fix involves configuring your antivirus to exclude the Git repository folder or temporarily disabling real-time protection during Git operations.
The "Permission denied (possibly blocked by antivirus)" error indicates that Git is unable to read, write, or modify a file in your repository because Windows antivirus software is holding a lock on it. This typically happens with Windows Defender or third-party antivirus programs that perform real-time file scanning. When Git attempts operations like `git checkout`, `git pull`, `git reset`, or `git clean`, it needs to read, create, modify, or delete files. If antivirus software is simultaneously scanning these files, it can temporarily lock them, causing Git to fail with a permission denied error. This issue is particularly common when: - **Cloning large repositories** with many files that trigger antivirus scanning - **Checking out branches** that modify executable files (.exe, .dll, .bat, .ps1) - **Running Git operations on repositories** containing script files or code that antivirus flags as suspicious - **Using Git in directories** that antivirus monitors heavily (like Downloads or Desktop) The "possibly blocked by antivirus" hint is Git's way of suggesting the most likely cause on Windows systems, where this pattern is well-documented.
The most effective fix is to exclude your Git repositories from Windows Defender scanning:
Via Windows Security Settings:
1. Open Windows Security (search for it in the Start menu)
2. Click Virus & threat protection
3. Under "Virus & threat protection settings", click Manage settings
4. Scroll down to Exclusions and click Add or remove exclusions
5. Click Add an exclusion and select Folder
6. Navigate to and select your repository folder (e.g., C:\Users\YourName\Projects\your-repo)
Via PowerShell (Administrator):
# Add a folder exclusion
Add-MpPreference -ExclusionPath "C:\Users\YourName\Projects"
# Or add the entire Git repositories parent directory
Add-MpPreference -ExclusionPath "C:\Users\YourName\repos"
# Verify the exclusion was added
Get-MpPreference | Select-Object -ExpandProperty ExclusionPathRecommended exclusions for developers:
- Your main projects/repos folder
- %USERPROFILE%\.git (Git config directory)
- %LOCALAPPDATA%\GitHubDesktop (if using GitHub Desktop)
- Your IDE's workspace folders
Also exclude the Git installation directory and related development tools:
Via PowerShell (Administrator):
# Exclude Git installation
Add-MpPreference -ExclusionPath "C:\Program Files\Git"
# If using Git for Windows in a different location
Add-MpPreference -ExclusionPath "C:\Users\YourName\AppData\Local\Programs\Git"
# Exclude process by name
Add-MpPreference -ExclusionProcess "git.exe"
Add-MpPreference -ExclusionProcess "git-remote-https.exe"
Add-MpPreference -ExclusionProcess "ssh.exe"Via Windows Security UI:
1. Go to Windows Security > Virus & threat protection > Manage settings
2. Under Exclusions, click Add or remove exclusions
3. Click Add an exclusion > Process
4. Type git.exe and click Add
This prevents Defender from scanning Git itself during operations, which can significantly speed up Git commands.
Windows 10/11's Controlled Folder Access (ransomware protection) can block Git from modifying files:
Check if Controlled Folder Access is enabled:
1. Open Windows Security
2. Go to Virus & threat protection > Manage ransomware protection
3. Check if Controlled folder access is turned on
Allow Git through Controlled Folder Access:
1. Click Allow an app through Controlled folder access
2. Click Add an allowed app > Browse all apps
3. Navigate to Git's installation and select:
- C:\Program Files\Git\bin\git.exe
- C:\Program Files\Git\cmd\git.exe
- C:\Program Files\Git\mingw64\bin\git.exe
Via PowerShell (Administrator):
# Allow Git through Controlled Folder Access
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Git\bin\git.exe"
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Git\cmd\git.exe"If you primarily work in specific folders, you can also remove those folders from protected folders list, though this reduces ransomware protection for those locations.
If you use third-party antivirus software, add similar exclusions there:
Norton:
1. Open Norton
2. Go to Settings > Antivirus > Scans and Risks
3. Under Exclusions / Low Risks, click Configure
4. Add your repository folders
McAfee:
1. Open McAfee
2. Go to Real-Time Scanning > Excluded Files
3. Click Add file or folder
4. Add your repository folders
Avast/AVG:
1. Open Avast/AVG
2. Go to Menu > Settings > General > Exceptions
3. Click Add Exception
4. Add your repository folders
Kaspersky:
1. Open Kaspersky
2. Go to Settings > Additional > Threats and Exclusions
3. Click Manage exclusions > Add
4. Add your repository folders
ESET:
1. Open ESET
2. Go to Setup > Advanced Setup > Detection Engine
3. Click Exclusions > Performance Exclusions
4. Add your repository folders
Always exclude both the repository folder and the Git executable path.
As a quick workaround, you can temporarily disable real-time protection during Git operations:
Disable Windows Defender temporarily:
1. Open Windows Security
2. Go to Virus & threat protection > Manage settings
3. Turn off Real-time protection
4. Run your Git command
5. Important: Turn real-time protection back on immediately after
Via PowerShell (Administrator) - temporary disable:
# Disable real-time monitoring (requires admin)
Set-MpPreference -DisableRealtimeMonitoring $true
# Run your Git commands here
git checkout main
git pull
# Re-enable real-time monitoring immediately
Set-MpPreference -DisableRealtimeMonitoring $falseWarning: This is only a temporary workaround. Do not leave real-time protection disabled. The exclusion method (Step 1) is the proper long-term solution.
If you must use this approach frequently, create a batch script that disables protection, runs Git, and re-enables protection automatically.
If the error is intermittent (works sometimes, fails others), the antivirus may release locks quickly. You can retry the operation:
Simple retry:
# Wait a moment and retry
sleep 2 && git checkout main
# Or in PowerShell
Start-Sleep -Seconds 2; git checkout mainRetry loop in PowerShell:
$maxRetries = 5
$retryCount = 0
$success = $false
while (-not $success -and $retryCount -lt $maxRetries) {
try {
git checkout main
$success = $true
} catch {
$retryCount++
Write-Host "Attempt $retryCount failed, retrying in 3 seconds..."
Start-Sleep -Seconds 3
}
}
if (-not $success) {
Write-Host "Command failed after $maxRetries attempts"
}Retry loop in Bash (Git Bash):
for i in {1..5}; do
git checkout main && break
echo "Attempt $i failed, retrying in 3 seconds..."
sleep 3
doneThis is a workaround, not a fix. Configure proper exclusions for a permanent solution.
To identify exactly which process is locking the file, use Microsoft's Process Explorer:
Download and run Process Explorer:
1. Download from: https://docs.microsoft.com/sysinternals/downloads/process-explorer
2. Run procexp64.exe as Administrator
3. Press Ctrl+F to open the Find dialog
4. Enter the filename that Git cannot access (e.g., file.txt)
5. Click Search
The results will show which process has a handle to the file. Common culprits:
- MsMpEng.exe - Windows Defender
- avp.exe - Kaspersky
- mcshield.exe - McAfee
- avgnt.exe - Avira
Using Handle.exe (command line):
# Download Handle from Sysinternals, then:
handle.exe "file.txt"Using PowerShell to find locked files:
# Find processes with handles to files in a directory
Get-Process | ForEach-Object {
$handles = $_.Handles
if ($_.Path -like "*git*") {
Write-Host $_.ProcessName $_.Id
}
}Once you identify the locking process, you can configure exclusions specific to that antivirus.
Some Windows locations are monitored more heavily by antivirus. Moving your repository can help:
Heavily monitored locations (avoid for development):
- C:\Users\YourName\Downloads
- C:\Users\YourName\Desktop
- C:\Users\YourName\Documents
- Temporary directories
Better locations for Git repositories:
- C:\dev or D:\dev (dedicated development folder)
- C:\Users\YourName\repos (dedicated repos folder)
- Any folder you've added to exclusions
Move your repository:
# In Git Bash or terminal
mv /c/Users/YourName/Downloads/my-repo /c/dev/my-repo
# Update any IDE workspace paths
# Re-open the project in your IDE from the new locationClone to a better location instead:
# Instead of cloning to Downloads
git clone https://github.com/user/repo.git /c/dev/repoOnce you have a dedicated development folder, add it to your antivirus exclusions as described in Step 1.
Why Antivirus Blocks Git on Windows:
Windows antivirus software uses real-time file monitoring that intercepts file operations at the kernel level. When Git tries to access a file, the antivirus intercepts the request, scans the file, and then allows or blocks the operation. This causes issues because:
1. Scanning takes time - Git expects instant file access but antivirus adds latency
2. Exclusive locks - Some antivirus holds exclusive locks during scanning, preventing Git from accessing the file
3. Heuristic detection - Code files, scripts, and compiled binaries often trigger heuristic scanning which takes longer
4. Quarantine operations - Suspected files may be temporarily moved during analysis
Git Operations Most Affected:
Operations that touch many files are most likely to hit antivirus conflicts:
- git clone (creates all files at once)
- git checkout (switches files rapidly)
- git pull / git merge (modifies multiple files)
- git clean (deletes files that antivirus may be monitoring)
- git reset --hard (replaces files)
Single-file operations like git add or git diff rarely trigger this issue.
Impact on Git Performance:
Even when antivirus doesn't cause errors, it significantly slows Git on Windows:
- Status checks can be 10-100x slower with real-time scanning
- Large clones can take minutes instead of seconds
- Checkout operations have noticeable delays
Adding proper exclusions can dramatically improve Git performance on Windows.
Enterprise Environments:
In corporate environments, you may not have permission to modify antivirus settings. In this case:
- Contact your IT department to request developer exclusions
- Ask about approved development folder locations
- Request that Git be added to the organization's antivirus whitelist
- Document the performance impact for IT to justify the exclusion request
WSL as an Alternative:
If antivirus issues persist and cannot be resolved, consider using Windows Subsystem for Linux (WSL) for Git operations:
# Install WSL
wsl --install
# Clone and work in WSL filesystem
wsl
cd ~
git clone https://github.com/user/repo.gitWSL has its own Linux filesystem that Windows antivirus doesn't monitor by default, eliminating these conflicts. However, working across the Windows/WSL boundary has its own performance considerations.
Security Considerations:
While excluding development folders improves Git performance, understand the trade-offs:
- Code repositories are less likely to contain malware (especially trusted sources)
- Your own code is unlikely to be malicious
- Third-party dependencies (node_modules, vendor, etc.) could theoretically contain malware
- Consider periodic manual scans of development folders
A balanced approach is to exclude your own repositories while letting antivirus scan downloaded dependencies during initial install.
Windows Defender SmartScreen:
Separately from real-time protection, SmartScreen may block downloaded Git executables or scripts. This manifests as "Windows protected your PC" warnings, not permission denied errors. Allow the application through SmartScreen or download from official sources.
kex_exchange_identification: Connection closed by remote host
Connection closed by remote host when connecting to Git server
fatal: unable to access: Proxy auto-configuration failed
How to fix 'Proxy auto-configuration failed' in Git
fatal: unable to access: Authentication failed (proxy requires basic auth)
How to fix 'Authentication failed (proxy requires basic auth)' in Git
fatal: unable to access: no_proxy configuration not working
How to fix 'no_proxy configuration not working' in Git
fatal: unable to read tree object in treeless clone
How to fix 'unable to read tree object in treeless clone' in Git