A command line tool, afsdacl.exe, can be used to restrict the ability to start and stop the OpenAFS Client Service.
afsdacl : Set or reset the DACL to allow starting or stopping the afsd service by any ordinary user. Usage: afsdacl [-set | -reset] [-show] -set : Sets the DACL -reset : Reset the DACL -show : Show current DACL (SDSF)