If you have enabled the token expiration options in the DeviceID policy, then you must also set up the task called "Token Notification Service"