If your workstation's initial login screen is the Novell Client login screen (NetWare Graphical Identification and Authentication (NWGINA)), it is invoked when you try to unlock the workstation after it is locked. If you have logged in using the Kerberos Login Method for NMAS, when you unlock the workstation you are prompted for the Kerberos password to acquire a fresh TGT and Service Ticket to log in to eDirectory. If this is successful, the workstation is unlocked.
Every time you lock and unlock the workstation, fresh tickets are obtained from the KDC and validated.
If the Microsoft workstation login (Microsoft Graphical Identification and Authentication (MSGINA)) is the primary workstation login, it is invoked when you attempt to unlock the workstation. This handles the user password validation. In this case, the NMAS Kerberos LCM is not involved in the unlock procedure.