diff --git a/src/WINNT/netidmgr_plugin/afsfuncs.c b/src/WINNT/netidmgr_plugin/afsfuncs.c
index 2b4ea4de05..9a6e7a17e6 100644
--- a/src/WINNT/netidmgr_plugin/afsfuncs.c
+++ b/src/WINNT/netidmgr_plugin/afsfuncs.c
@@ -880,7 +880,7 @@ afs_klog(khm_handle identity,
 	* and try again.  Perhaps there are two service tickets for the
 	* same service in the ccache.
 	*/
-	if (k5creds->times.endtime < time(NULL)) {
+	if (r == 0 && k5creds && k5creds->times.endtime < time(NULL)) {
 	    pkrb5_cc_remove_cred(context, k5cc, 0, k5creds);
 	    pkrb5_free_creds(context, k5creds);
 	    k5creds = NULL;