[FYI] Version 0.58.0 blocked by corporate Windows security policies

[kristian-t-s]

Summary

Just a heads up: lazygit 0.58.0 is being blocked by Microsoft Defender Exploit Guard in my corporate environment, while 0.57.0 runs fine. Not a bug but figured this information might be useful for other users in restricted environments.

---

Environment

• OS: Windows 10/11 Enterprise (corporate managed)
• Installation: Scoop package manager
• Security: No admin privileges, Microsoft Defender Exploit Guard enabled
• What works: 0.57.0 runs perfectly
• What doesn't: 0.58.0 gets blocked

---

What I'm Seeing

Scoop shim creation fails:

PS> scoop reset lazygit@0.58.0
Resetting lazygit (0.58.0).
Linking D:\Scoop\apps\lazygit\current => D:\Scoop\apps\lazygit\0.58.0
Creating shim for 'lazygit'.
You cannot call a method on a null-valued expression.
At D:\Scoop\apps\scoop\current\lib\core.ps1:19 char:9
+         $binaryReader.Close()

Running via shim:

PS> lazygit
Shim: Could not determine if target is a GUI app. Assuming console.
Shim: Could not create process with command '"D:\Scoop\apps\lazygit\current\lazygit.exe" '.

Running 0.58.0 directly:

PS> & "D:\Scoop\apps\lazygit\0.58.0\lazygit.exe" --version
Program 'lazygit.exe' failed to run: Adgang nægtet (Access denied)

Meanwhile, 0.57.0 works fine:

PS> scoop reset lazygit@0.57.0
Resetting lazygit (0.57.0).
Linking D:\Scoop\apps\lazygit\current => D:\Scoop\apps\lazygit\0.57.0
Creating shim for 'lazygit'.

PS> lazygit --version
commit=17d03ec8cb89d4c65fd129228164562a220abefb, build date=2025-12-06T13:01:50Z, build source=binaryRelease, version=0.57.0, os=windows, arch=amd64, git version=2.52.0.windows.1

Event Viewer shows:

Event ID: 1121 (Microsoft-Windows-Windows Defender/Operational)
Message: "Microsoft Defender Exploit Guard has blocked an action not allowed by your IT administrator"

Got 11 of these events during testing, one for each execution attempt. Zero blocks when running 0.57.0.

---

Technical Details

File comparison:

Version	Mode	Attributes	Size	Result
0.57.0	-a----	Archive	22,369,280 bytes	Works
0.58.0	------	Normal (none)	22,535,168 bytes	Blocked

Other observations:

• NTFS permissions identical on both versions
• No zone identifiers on either file
• Setting Archive attribute manually on 0.58.0 didn't help
• Both in same directory: D:\Scoop\apps\lazygit\

---

Why I'm Posting

Honestly, I was in doubt whether this should be posted in 'Issues' or here. But I figured other people in corporate environments might hit this same issue, so wanted it documented somewhere searchable without unnecessarily escalating it to an 'Issue'. Also thought you might want to know that something in the 0.58.0 build is triggering Exploit Guard, even though I have no idea what or why.

For now, I'll stay on 0.57.0 and try again later. Until now I'm happy to say that Windows Defender hasn't even raised an eyebrow when I've used lazygit.

Happy to provide more diagnostic info if it would help and thank you for a great tool!

---

Diagnostic commands I used:

Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | Where-Object {$_.Message -like "*lazygit*"}
Get-Acl "D:\Scoop\apps\lazygit\0.58.0\lazygit.exe"
Get-Item "D:\Scoop\apps\lazygit\0.58.0\lazygit.exe" | Select-Object Mode, Attributes