diff --git a/win32ss/user/ntuser/main.c b/win32ss/user/ntuser/main.c
index 46364a10089..62e1f157271 100644
--- a/win32ss/user/ntuser/main.c
+++ b/win32ss/user/ntuser/main.c
@@ -180,6 +180,12 @@ UserProcessDestroy(PEPROCESS Process)
     if (ppiScrnSaver == ppiCurrent)
         ppiScrnSaver = NULL;
 
+    if (gpwlCache)
+    {
+        ExFreePoolWithTag(gpwlCache, USERTAG_WINDOWLIST);
+        gpwlCache = NULL;
+    }
+
     /* Destroy user objects */
     UserDestroyObjectsForOwner(gHandleTable, ppiCurrent);
 
@@ -697,6 +703,7 @@ ExitThreadCallback(PETHREAD Thread)
     PPROCESSINFO ppiCurrent;
     PEPROCESS Process;
     PTHREADINFO ptiCurrent;
+    PWINDOWLIST pwl, pwlNext;
 
     Process = Thread->ThreadsProcess;
 
@@ -714,6 +721,16 @@ ExitThreadCallback(PETHREAD Thread)
 
     IsRemoveAttachThread(ptiCurrent);
 
+    if (gpwlList)
+    {
+        for (pwl = gpwlList; pwl; pwl = pwlNext)
+        {
+            pwlNext = pwl->pNextList;
+            if (pwl->pti == ptiCurrent)
+                IntFreeHwndList(pwl);
+        }
+    }
+
     ptiCurrent->TIF_flags |= TIF_DONTATTACHQUEUE;
     ptiCurrent->pClientInfo->dwTIFlags = ptiCurrent->TIF_flags;
 
diff --git a/win32ss/user/ntuser/window.h b/win32ss/user/ntuser/window.h
index fd63e1c920f..7086af36fc5 100644
--- a/win32ss/user/ntuser/window.h
+++ b/win32ss/user/ntuser/window.h
@@ -90,6 +90,9 @@ typedef struct tagWINDOWLIST
     HWND ahwnd[ANYSIZE_ARRAY]; /* Terminated by HWND_TERMINATOR */
 } WINDOWLIST, *PWINDOWLIST;
 
+extern PWINDOWLIST gpwlList;
+extern PWINDOWLIST gpwlCache;
+
 #define WL_IS_BAD(pwl)   ((pwl)->phwndEnd <= (pwl)->phwndLast)
 #define WL_CAPACITY(pwl) ((pwl)->phwndEnd - &((pwl)->ahwnd[0]))