diff --git a/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/NativeRequestContext.cs b/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/NativeRequestContext.cs
index a155b59363..7bcbb258b5 100644
--- a/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/NativeRequestContext.cs
+++ b/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/NativeRequestContext.cs
@@ -224,8 +224,14 @@ namespace Microsoft.AspNetCore.Server.HttpSys
                     && info->InfoType == HttpApi.HTTP_REQUEST_INFO_TYPE.HttpRequestInfoTypeAuth
                     && info->pInfo->AuthStatus == HttpApi.HTTP_AUTH_STATUS.HttpAuthStatusSuccess)
                 {
-                    return new WindowsPrincipal(new WindowsIdentity(info->pInfo->AccessToken,
-                        GetAuthTypeFromRequest(info->pInfo->AuthType).ToString()));
+                    // Duplicates AccessToken
+                    var identity = new WindowsIdentity(info->pInfo->AccessToken,
+                        GetAuthTypeFromRequest(info->pInfo->AuthType).ToString());
+
+                    // Close the original
+                    UnsafeNclNativeMethods.SafeNetHandles.CloseHandle(info->pInfo->AccessToken);
+
+                    return new WindowsPrincipal(identity);
                 }
             }
 
diff --git a/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/Request.cs b/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/Request.cs
index d8a03d2cf9..043790f8e0 100644
--- a/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/Request.cs
+++ b/src/Microsoft.AspNetCore.Server.HttpSys/RequestProcessing/Request.cs
@@ -302,6 +302,7 @@ namespace Microsoft.AspNetCore.Server.HttpSys
             // TODO: Verbose log
             _isDisposed = true;
             _nativeRequestContext.Dispose();
+            (User?.Identity as WindowsIdentity)?.Dispose();
             if (_nativeStream != null)
             {
                 _nativeStream.Dispose();