A old text, but please see How Security Groups are Used in Access Control as it explain the process. The token is refreshed when your logoff/login happen
When a user or group is given permission to access a resource, such as a printer or a file share, the SID of the user or group is added to the access control entry (ACE) defining the granted permission in the resource's discretionary access control list (DACL). In Active Directory Domain Services, each object has an nTSecurityDescriptor attribute that stores a DACL defining the access to that particular object or attributes on that object. For more information about setting access control on objects in Active Directory Domain Services, see Controlling Access to Objects in Active Directory Domain Services.
When a user logs on to a Windows 2000 domain, the operating system generates an access token. This access token is used to determine which resources the user may access. The user access token includes the following data:
SIDs of all global and universal security groups that the user is a member of.
SIDs of all nested global and universal security groups.
Every process executed on behalf of this user has a copy of this access token.
When the user attempts to access resources on a computer, the service through which the user accesses the resource will impersonate the user by creating a new access token based on the access token created at user logon time. This new access token will also contain the following SIDs:
SIDs for all domain local groups in the target domain that the user is a member of.
SIDs for all machine local groups on the target computer that the user is a member of.
The service uses this new access token to evaluate access to the resource. If a SID in the access token appears in any ACEs in the DACL, the service gives the user the permissions specified in those ACEs.