diff --git a/changes/bug3752 b/changes/bug3752
new file mode 100644
index 0000000000..270f1559cf
--- /dev/null
+++ b/changes/bug3752
@@ -0,0 +1,5 @@
+  o Major bugfixes:
+    - The IOCP backend now works even when the user has not specified
+      the (internal, debbuging-only) _UseFilteringSSLBufferevents option.
+      Fixes part of bug 3752; bugfix on 0.2.3.1-alpha.
+
diff --git a/src/common/compat_libevent.c b/src/common/compat_libevent.c
index 8752de7492..595742f961 100644
--- a/src/common/compat_libevent.c
+++ b/src/common/compat_libevent.c
@@ -164,6 +164,16 @@ struct event_base *the_event_base = NULL;
 #endif
 #endif
 
+#ifdef USE_BUFFEREVENTS
+static int using_iocp_bufferevents = 0;
+
+int
+tor_libevent_using_iocp_bufferevents(void)
+{
+  return using_iocp_bufferevents;
+}
+#endif
+
 /** Initialize the Libevent library and set up the event base. */
 void
 tor_libevent_initialize(tor_libevent_cfg *torcfg)
@@ -187,6 +197,7 @@ tor_libevent_initialize(tor_libevent_cfg *torcfg)
     if (! torcfg->disable_iocp) {
       evthread_use_windows_threads();
       event_config_set_flag(cfg, EVENT_BASE_FLAG_STARTUP_IOCP);
+      using_iocp_bufferevents = 1;
     }
 #endif
 
diff --git a/src/common/compat_libevent.h b/src/common/compat_libevent.h
index 8669fd4e0b..bbe105bf40 100644
--- a/src/common/compat_libevent.h
+++ b/src/common/compat_libevent.h
@@ -73,6 +73,7 @@ const char *tor_libevent_get_version_str(void);
 #ifdef USE_BUFFEREVENTS
 #define TOR_LIBEVENT_TICKS_PER_SECOND 3
 const struct timeval *tor_libevent_get_one_tick_timeout(void);
+int tor_libevent_using_iocp_bufferevents(void);
 #endif
 
 #endif
diff --git a/src/common/tortls.c b/src/common/tortls.c
index 455603030f..2aaa2c49b5 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -1892,7 +1892,7 @@ tor_tls_init_bufferevent(tor_tls_t *tls, struct bufferevent *bufev_in,
   const enum bufferevent_ssl_state state = receiving ?
     BUFFEREVENT_SSL_ACCEPTING : BUFFEREVENT_SSL_CONNECTING;
 
-  if (filter) {
+  if (filter || tor_libevent_using_iocp_bufferevents()) {
     /* Grab an extra reference to the SSL, since BEV_OPT_CLOSE_ON_FREE
        means that the SSL will get freed too.