git-ecosystem/git-credential-manager · error · Exception

Unable to persist credentials with the

Error message

Unable to persist credentials with the '{StoreNames.WindowsCredentialManager}' credential store.
See {Constants.HelpUrls.GcmCredentialStores} for more information.

What it means

ValidateWindowsCredentialManager also checks WindowsCredentialManager.CanPersist() on Windows itself. If Credential Manager cannot persist credentials (e.g. no writable credential vault, restricted service, or a stripped-down environment), GCM throws this error indicating the wincredman store is unusable on this machine.

Solutions

Switch to another store: `git config --global credential.credentialStore dpapi` (with a store root) or plaintext/cache for non-interactive contexts.
Ensure the Credential Manager (VaultSvc / 'Credential Manager') service is running and not disabled by policy.
Run GCM under an interactive user account with a writable user profile instead of a service/CI identity.
Check enterprise/group policy restrictions and ask IT to allow credential persistence.

Example fix

// before (CI container without Credential Manager)
[credential]
	credentialStore = wincredman

// after
[credential]
	credentialStore = dpapi

Defensive patterns

Strategy: fallback

Validate before calling

// Windows-only preflight
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows) && store == "wincredman")
{
    using var ps = System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo("sc.exe", "query VaultSvc") { RedirectStandardOutput = true, UseShellExecute = false });
    string output = ps.StandardOutput.ReadToEnd(); ps.WaitForExit();
    if (!output.Contains("RUNNING")) throw new InvalidOperationException("Credential Manager service unavailable; use dpapi or plaintext");
}

Try / catch

try
{
    credentialStore.Get(serviceName);
}
catch (Exception ex) when (ex.Message.Contains("Unable to persist credentials"))
{
    // fall back to a non-Credential-Manager store (dpapi/cache/plaintext)
}

Prevention

Verify the Credential Manager (VaultSvc) service is running on Windows hosts.
Prefer dpapi/cache in service accounts, CI runners and containers.
Avoid wincredman in minimal Windows images.
Check enterprise policy before standardizing on Credential Manager.

When it happens

Trigger: EnsureBackingStore -> ValidateWindowsCredentialManager where PlatformUtils.IsWindows() is true but WindowsCredentialManager.CanPersist() returns false — the Credential Manager API cannot write/persist entries in the current environment.

Common situations: Running inside restricted Windows service accounts or sandboxed CI runners with the Credential Manager service disabled; locked-down enterprise policies; minimal Windows containers lacking the Credential Manager runtime.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/11837b6f40977002. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/CredentialStore.cs:212

                Environment.NewLine, StoreNames.None);
        }

        private void ValidateWindowsCredentialManager()
        {
            if (!PlatformUtils.IsWindows())
            {
                var message = $"Can only use the '{StoreNames.WindowsCredentialManager}' credential store on Windows.";
                _context.Trace2.WriteError(message);
                throw new Exception(message + Environment.NewLine +
                            $"See {Constants.HelpUrls.GcmCredentialStores} for more information."
                );
            }

            if (!WindowsCredentialManager.CanPersist())
            {
                var message = $"Unable to persist credentials with the '{StoreNames.WindowsCredentialManager}' credential store.";
                _context.Trace2.WriteError(message);
                throw new Exception(message + Environment.NewLine +
                    $"See {Constants.HelpUrls.GcmCredentialStores} for more information."
                );
            }
        }

        private void ValidateDpapi(out string storeRoot)
        {
            if (!PlatformUtils.IsWindows())
            {
                var message = $"Can only use the '{StoreNames.Dpapi}' credential store on Windows.";
                _context.Trace2.WriteError(message);
                throw new Exception(message  + Environment.NewLine +
                    $"See {Constants.HelpUrls.GcmCredentialStores} for more information."
                );
            }

            // Check for a redirected credential store location
            if (!_context.Settings.TryGetSetting(

View on GitHub (pinned to e8ce762cd0)