diff --git a/hadoop-yarn-project/CHANGES.txt b/hadoop-yarn-project/CHANGES.txt
index a26bfb2f1d..97b67b5258 100644
--- a/hadoop-yarn-project/CHANGES.txt
+++ b/hadoop-yarn-project/CHANGES.txt
@@ -900,6 +900,9 @@ Release 2.6.0 - UNRELEASED
 
     YARN-2827. Fixed bugs in "yarn queue" CLI. (Wangda Tan via vinodkv)
 
+    YARN-2803. MR distributed cache not working correctly on Windows after
+    NodeManager privileged account changes. (Craig Welch via cnauroth)
+
 Release 2.5.2 - UNRELEASED
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/launcher/ContainerLaunch.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/launcher/ContainerLaunch.java
index 57e3bb9e84..8fc5ea3dd8 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/launcher/ContainerLaunch.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/launcher/ContainerLaunch.java
@@ -71,6 +71,7 @@
 import org.apache.hadoop.yarn.server.nodemanager.containermanager.container.ContainerState;
 import org.apache.hadoop.yarn.server.nodemanager.containermanager.localizer.ContainerLocalizer;
 import org.apache.hadoop.yarn.server.nodemanager.containermanager.localizer.ResourceLocalizationService;
+import org.apache.hadoop.yarn.server.nodemanager.WindowsSecureContainerExecutor;
 import org.apache.hadoop.yarn.server.nodemanager.util.ProcessIdFileReader;
 import org.apache.hadoop.yarn.util.Apps;
 import org.apache.hadoop.yarn.util.AuxiliaryServiceHelper;
@@ -767,8 +768,17 @@ public void sanitizeEnv(Map<String, String> environment, Path pwd,
           System.getenv());
         mergedEnv.putAll(environment);
         
+        // this is hacky and temporary - it's to preserve the windows secure
+        // behavior but enable non-secure windows to properly build the class
+        // path for access to job.jar/lib/xyz and friends (see YARN-2803)
+        Path jarDir;
+        if (exec instanceof WindowsSecureContainerExecutor) {
+          jarDir = nmPrivateClasspathJarDir;
+        } else {
+          jarDir = pwd; 
+        }
         String[] jarCp = FileUtil.createJarWithClassPath(
-          newClassPath.toString(), nmPrivateClasspathJarDir, pwd, mergedEnv);
+          newClassPath.toString(), jarDir, pwd, mergedEnv);
         // In a secure cluster the classpath jar must be localized to grant access
         Path localizedClassPathJar = exec.localizeClasspathJar(
             new Path(jarCp[0]), pwd, container.getUser());