SmartCardLogon via RDP complains about EventID 5. Why?

Question

Active Directory

Situation: AD, 3-d party CA, RDP login, eToken certificate
On the first attempt to log in via RDP, the target computer swears that it is impossible to log in using this smart card, but opens a welcome screen with an invitation to enter a username / password and the opportunity to choose a login with a smart card - and now it lets you through the welcome screen on the smart card.
Why is that? Where to dig?

Answer 1

I am answering my own question:
When issuing the certificate, the generation of the private key by the token itself was used -> eToken Base Cryptographic Provider
The station from which the login was made did not know anything about this cryptographic provider, but the server did.
Accordingly, installing the eToken PKI Client on the station solved the problem.