Citrix not accepting password when updating app set?

Question

Citrix

Initially, the question is: “What is the difference between authentication in Citrix when downloading a set of applications from authentication when entering the application itself?”, But any useful information on the topic is interested.
The essence of the problem is as follows. There is a set of applications that runs through the Citrix Program Neighborhood. NT authentication is used with a domain user account. It would seem that you need to install Nateborhud with SSO support and a pre-installed connection, and a new user will immediately have a working set of applications when they first log in under their account. At least make shortcuts to the desktop in "All Users". But. When launched under a new user, Nateborhud sees this very set of applications, but tries to update it, and writes that the password is incorrect. Though with pass-through authentication, at least manually enter the password - the same. If you restart it a couple of times, re-login a couple of times, reboot, then from the nth time it still starts up, loads a set of applications and then starts up without problems until the first password change or manual update of the set. In general, dancing with a tambourine. As a workaround, I use a self-extracting archive with a cached set of applications from %USERPROFILE%\Application Data\ICAClient. If you unpack it into a user profile, then the applications themselves run without problems.
The problem is quite old, but now I really really wanted to figure it out. The situation is complicated by the fact that the Citrix servers are located in another city at the head office. I have no influence on the admins, I can only suggest something. As far as I understand, everything is fine with them there.
Additionally:
1) The domain with the head office is common. Two controllers are in our site.
2) In the Windows log, there are no events in any way related to Citrix.
3) In the log of Citrix itself, an input is registered and immediately an output:

10-11-2012  17:55:17:732 FARM: CONNECTED to 'FARM:FARM'
10-11-2012  17:55:21:935 FARM: DISCONNECTED from 'FARM:FARM'
10-11-2012  17:55:30:653 FARM: CONNECTED to 'FARM:FARM'
10-11-2012  17:55:40:168 FARM: DISCONNECTED from 'FARM:FARM'

A task for the participants of the "Battle of Psychics" program!

Answer 1

Check if there is a time streak. Kerberos does not like this very much, and not only him.