RDS connection failed on second prompt

[milon03]

Hello

We are running RDS connection broker on server 2012. Some user can connect without any issue and others unable to connect on second password prompt (they can login to the remote apps page but after download opening the remote app it ask for user name and password). It keeps saying invalid logging details. Checking the event log I get the following error.

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server xx-xx$. The target name used was HTTP/portal.xx.com. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (xx.com)is different from the client domain (xx.com), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

We use per device cal and there are plenty cal available. I don't understand why it is working for some devices but not the other.

Any guide us which way we should start to troubleshoot.

Update- It is working for clients within the same network but getting login attempt failed if it is outside network for the same client machine. For some users it is working from over the internet. Really confused.

Thanks