diff --git a/ChangeLog.txt b/ChangeLog.txt
index 8db5d839..650a4273 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -4,6 +4,7 @@
 Broker:
 - Fix QoS 1 / QoS 2 publish incorrectly returning "no subscribers".
   Closes #3128.
+- Open files with appropriate access on Windows. Closes #3119.
 
 Client library:
 - Fix cmake build on OS X. Closes #3125.
diff --git a/lib/misc_mosq.c b/lib/misc_mosq.c
index 844c9b6d..fb1db2a7 100644
--- a/lib/misc_mosq.c
+++ b/lib/misc_mosq.c
@@ -67,24 +67,31 @@ FILE *mosquitto__fopen(const char *path, const char *mode, bool restrict_read)
 			DWORD ulen = UNLEN;
 			SECURITY_DESCRIPTOR sd;
 			DWORD dwCreationDisposition;
+			DWORD dwShareMode;
 			int fd;
 			FILE *fptr;
 
 			switch(mode[0]){
 				case 'a':
 					dwCreationDisposition = OPEN_ALWAYS;
+					dwShareMode = GENERIC_WRITE;
 					flags = _O_APPEND;
 					break;
 				case 'r':
 					dwCreationDisposition = OPEN_EXISTING;
+					dwShareMode = GENERIC_READ;
 					flags = _O_RDONLY;
 					break;
 				case 'w':
 					dwCreationDisposition = CREATE_ALWAYS;
+					dwShareMode = GENERIC_WRITE;
 					break;
 				default:
 					return NULL;
 			}
+			if(mode[1] == '+'){
+				dwShareMode = GENERIC_READ | GENERIC_WRITE;
+			}
 
 			GetUserNameA(username, &ulen);
 			if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION)) {
@@ -104,7 +111,7 @@ FILE *mosquitto__fopen(const char *path, const char *mode, bool restrict_read)
 			sec.bInheritHandle = FALSE;
 			sec.lpSecurityDescriptor = &sd;
 
-			hfile = CreateFileA(buf, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ,
+			hfile = CreateFileA(buf, dwShareMode, FILE_SHARE_READ,
 				&sec,
 				dwCreationDisposition,
 				FILE_ATTRIBUTE_NORMAL,