A command line tool, afsdacl.exe, can be used to restrict the ability to start and stop the OpenAFS Client Service.

    afsdacl : Set or reset the DACL to allow starting or stopping
              the afsd service by any ordinary user.

    Usage: afsdacl [-set | -reset] [-show]
           -set   : Sets the DACL
           -reset : Reset the DACL
           -show  : Show current DACL (SDSF)