diff --git a/recipes/_install-windows.rb b/recipes/_install-windows.rb
index 1c4aa0c1..feda4c58 100644
--- a/recipes/_install-windows.rb
+++ b/recipes/_install-windows.rb
@@ -17,6 +17,29 @@
 # limitations under the License.
 #
 
+include_recipe 'chef_handler'
+
+module Windows
+  class Helper
+    def do_cleanup(context)
+      Chef::Log.info 'Windows environment vars cleanup started.'
+      resource = context.resource_collection.lookup('windows_env[DDAGENTUSER_NAME]')
+      resource.run_action(:delete) if resource
+      resource = context.resource_collection.lookup('windows_env[DDAGENTUSER_PASSWORD]')
+      resource.run_action(:delete) if resource
+      Chef::Log.info 'Windows environment vars cleanup finished.'
+    end
+  end
+end
+
+Chef.event_handler do
+  on :run_failed do
+    Windows::Helper.new.do_cleanup(
+      Chef.run_context
+    )
+  end
+end
+
 dd_agent_version = Chef::Datadog.agent_version(node)
 
 if dd_agent_version.nil?
@@ -144,8 +167,10 @@
 
 windows_env 'DDAGENTUSER_NAME' do
   action :delete
+  sensitive true
 end
 
 windows_env 'DDAGENTUSER_PASSWORD' do
   action :delete
+  sensitive true
 end