diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 7ccc8866f6d..46a642607bb 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -661,6 +661,9 @@ Release 2.6.0 - UNRELEASED
     HADOOP-11122. Fix findbugs in ZK DelegationTokenSecretManagers.
     (Arun Suresh via kasha)
 
+    HADOOP-11228. Winutils task: unsecure path should not call
+    AddNodeManagerAndUserACEsToObject. (Remus Rusanu via jianhe)
+
 Release 2.5.1 - 2014-09-05
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-common-project/hadoop-common/src/main/winutils/task.c b/hadoop-common-project/hadoop-common/src/main/winutils/task.c
index f0fc19a7543..bfdbd63710a 100644
--- a/hadoop-common-project/hadoop-common/src/main/winutils/task.c
+++ b/hadoop-common-project/hadoop-common/src/main/winutils/task.c
@@ -627,11 +627,13 @@ DWORD CreateTaskImpl(__in_opt HANDLE logonHandle, __in PCWSTR jobObjName,__in PC
     return dwErrorCode;
   }
 
-  dwErrorCode = AddNodeManagerAndUserACEsToObject(jobObject, userName, JOB_OBJECT_ALL_ACCESS);
-  if (dwErrorCode) {
-    ReportErrorCode(L"AddNodeManagerAndUserACEsToObject", dwErrorCode);
-    CloseHandle(jobObject);
-    return dwErrorCode;
+  if (logonHandle != NULL) {
+    dwErrorCode = AddNodeManagerAndUserACEsToObject(jobObject, userName, JOB_OBJECT_ALL_ACCESS);
+    if (dwErrorCode) {
+      ReportErrorCode(L"AddNodeManagerAndUserACEsToObject", dwErrorCode);
+      CloseHandle(jobObject);
+      return dwErrorCode;
+    }
   }
 
   if(AssignProcessToJobObject(jobObject, GetCurrentProcess()) == 0)
@@ -706,6 +708,8 @@ DWORD CreateTaskImpl(__in_opt HANDLE logonHandle, __in PCWSTR jobObjName,__in PC
          dwErrorCode = GetLastError();
          ReportErrorCode(L"CreateProcess", dwErrorCode);
       }
+
+    // task create (w/o createAsUser) does not need the ACEs change on the process
     goto create_process_done;
   }