After installing Git version 2.55.0.windows.1 on Windows, it is impossible to pull or push code using the domain account password

[crystalsu2001]

Existing issues matching what you're seeing

• I was not able to find an open or closed issue matching what I'm seeing

Git for Windows version

git version --build-options
git version 2.55.0.windows.1
cpu: x86_64
built from commit: bf5afdecc10478397d7059d07573630902fb2e2f
sizeof-long: 4
sizeof-size_t: 8
shell-path: D:/git-sdk-64-build-installers/usr/bin/sh
rust: disabled
feature: fsmonitor--daemon
gettext: enabled
libcurl: 8.21.0
OpenSSL: OpenSSL 3.5.7 9 Jun 2026
zlib: 1.3.2
SHA-1: SHA1_DC
SHA-256: SHA256_BLK
default-ref-format: files
default-hash: sha1

Windows version

Windows 11

Windows CPU architecture

x86_64 (64-bit)

Additional Windows version information

Microsoft Windows [版本 10.0.26200.8737]

Options set during installation

default

Other interesting things

No response

Terminal/shell

git bash

Commands that trigger the issue

After installing git version 2.53.0.windows.2 on Windows, it was impossible to pull and push code using domain account passwords. Searching online, I found that configuring git config --global http."xxx".allowNTLMAuth true would make it work normally. However, after upgrading git to version 2.55.0.windows.1, even after configuring git config --global http."xx".allowNTLMAuth true, it still reported authentication failure.

Expected behaviour

After entering the account password in the input field, the clone can be successfully retrieved.

Actual behaviour

can not pull or clone gitlab code error authentic failed

Repository

No response

[dscho]

Duplicate of #6307?

URGENT! After installing git version 2.53.0.windows.2 on Windows, it was impossible to pull and push code using domain account passwords. Searching online, I found that configuring git config --global http."http://your-server.com".allowNTLMAuth true would enable normal pulling and pushing. However, after upgrading the git version to 2.55.0.windows.1, even after configuring git config --global http."http://your-server.com".allowNTLMAuth true, it still reported authentication failure.

Unfortunately, this report does not clarify whether your domain is configured with NTLM authentication only. If that is the case, then the problem you encounter is that Git for Windows was made safer by default, refusing the weak NTLM authentication, and you indeed are stuck with opting out of that secure default until your domain administrator configures the domain in a way that lets you authenticate securely.

It is unclear to me, given the available information, whether NTLM is the only issue at play here. You may want to run with GIT_TRACE_CURL=1 and/or GCM_TRACE=1 to find out more. If you choose to share the output, do make sure that you redact it appropriately, especially given that you have to allow NTLM.

[crystalsu2001]

与#6307重复？

紧急！在 Windows 系统上安装 Git 2.53.0.windows.2 版本后，无法使用域帐户密码进行代码拉取和推送。我在网上搜索后发现，配置 git config --global http." [http://your-server.com".allowNTLMAuth](http://your-server.com%22.allowNTLMAuth) true 可以恢复正常的拉取和推送功能。但是，将 Git 版本升级到 2.55.0.windows.1 后，即使配置了 git config --global http." [http://your-server.com".allowNTLMAuth](http://your-server.com%22.allowNTLMAuth) true，仍然提示身份验证失败。

遗憾的是，这份报告并未说明您的域是否仅配置了 NTLM 身份验证。如果是这种情况，那么您遇到的问题是 Git for Windows 默认设置了更高的安全性，拒绝使用安全性较低的 NTLM 身份验证。在您的域管理员将域配置为允许您进行安全身份验证之前，您只能选择禁用此默认设置。

根据现有信息，我无法确定 NTLM 是否是唯一的问题所在。您可以尝试运行 GIT_TRACE_CURL=1and/or 命令GCM_TRACE=1来了解更多信息。如果您选择分享输出结果，请务必进行适当的编辑，_尤其_考虑到您必须允许 NTLM 身份验证。

I used Git 2.55.0.windows.2. Using this command, I cloned my repository. The following are some of the details: GIT_TRACE=1, GIT_CURL_VERBOSE=1, GCM_TRACE=1. git clone https://my.domain/xxx
15:48:59.823680 ... GitCommandBase.cs:53 trace: [ExecuteAsync] End 'get' command...
15:48:59.911402 http.c:1033 == Info: Reusing existing https: connection with host gitlab.test.com
15:48:59.911402 http.c:980 => Send header, 0000000233 bytes (0x000000e9)
15:48:59.911402 http.c:992 => Send header: GET /zuzu/test2.git/info/refs?service=git-upload-pack HTTP/1.1
15:48:59.911402 http.c:992 => Send header: Host: gitlab.test.com
15:48:59.911402 http.c:992 => Send header: User-Agent: git/2.55.0.windows.1
15:48:59.911402 http.c:992 => Send header: Accept: /
15:48:59.911402 http.c:992 => Send header: Accept-Encoding: deflate, gzip, br, zstd
15:48:59.911402 http.c:992 => Send header: Pragma: no-cache
15:48:59.911402 http.c:992 => Send header: Git-Protocol: version=2
15:48:59.911402 http.c:992 => Send header:
15:48:59.912395 http.c:1033 == Info: Request completely sent off
15:48:59.936662 http.c:980 <= Recv header, 0000000027 bytes (0x0000001b)
15:48:59.937649 http.c:992 <= Recv header: HTTP/1.1 401 Unauthorized
15:48:59.937649 http.c:980 <= Recv header, 0000000025 bytes (0x00000019) 15:48:59.937649 http.c:992 <= Received header: Cache-Control: no-cache
When I used Git 2.53.0.windows.2 to clone
14:24:51.025706 http.c:930 == Info: Connection #1 to host gitlab.test.com:443 remains intact
14:24:51.025706 http.c:930 == Info: Issue another request to this URL: 'https://gitlab.test.com/zuzu/test2.git/info/refs?service=git-upload-pack'
14:24:51.025706 http.c:930 == Info: Reusing existing https: connection with host gitlab.test.com
14:24:51.027711 http.c:930 == Info: Server authentication using NTLM with user 'zuzu'
14:24:51.027711 http.c:877 => Send header, 0000000863 bytes (0x0000035f)
14:24:51.027711 http.c:889 => Send header: GET /zuzu/test2.git/info/refs?service=git-upload-pack HTTP/1.1
14:24:51.027711 http.c:889 => Send header: Host: gitlab.test.com
14:24:51.027711 http.c:889 => Send header: Authorization: NTLM
14:24:51.027711 http.c:889 => Send header: User-Agent: git/2.53.0.windows.2
14:24:51.027711 http.c:889 => Send header: Accept: /
14:24:51.027711 http.c:889 => Send header: Accept-Encoding: deflate, gzip, br, zstd 14:24:51.027711 http.c:889 => Send header: Pragma: no-cache
14:24:51.027711 http.c:889 => Send header: Git-Protocol: version=2
14:24:51.027711 http.c:889 => Send header:
14:24:51.027711 http.c:930 == Info: Request completely sent off
14:24:51.128837 http.c:877 <= Recv header, 0000000017 bytes (0x00000011)
14:24:51.128837 http.c:889 <= Recv header: HTTP/1.1 200 OK
It seems that Git 2.55 does not send any Authorization/NTLM headers and completely fails to respond to NTLM.

[dscho]

@crystalsu2001 could you re-run that test with GIT_TRACE_CURL=1 instead of GIT_CURL_VERBOSE=1? Do redact any sensitive information, of course. I fear that we're not getting enough details about the NTLM negotiation from that trace.