When you lock and unlock your screen (in Windows), your Kerberos tickets are refreshed. You can see this by opening up a command prompt (not as admin) and running the klist command. This can include many tickets, but if you scroll to the top of your list you will see your ticket granting ticket (tgt). You should see an expiration date/time. Now run the tokens command. You will probably see (at least if it’s a fresh login) that the expiration times match your tgt expiration times pretty closely.
Now lock and unlock your machine and run those commands again. You will see your kerberos tickets were refreshed, but your tokens were not.
A somewhat simple way to work around this is to set up a task in task scheduler for your user:
1. Run only when user is logged in
2. Trigger: on workstation unlock
3. Action -> Start a Program
Program/script: %comspec%
(beyond that tweak whatever settings you might want.
Anyway it’s a quick and dirty way to have your AFS tokens renew alongside your Kerberos tickets.