An AD user cannot connect to a Windows node when the connection is tunneled by the cloud server and the user doesn't have already a process running on the remote desktop. In this case he/she gets a spinning wheel in the client displaying 'Connecting to nodename'. User can instead connect directly to the Enterprise Desktop server installed on that node.

As a workaround, enable 'further authentication' for the affected node.