PAM account validation for connections by NX protocol with NoMachine v. 6.12.3 fails when the following conditions are both met: 

1) the Kerberos ticket is obtained during PAM authentication (e.g with the pam_krb5.so module)

and

2) the PAM modules from account stack need to use root's privileges, like when pam_access needs to open access.conf

This can lead to multiple issues, like users being unable to login or failures when trying to add a child server to a Cloud Server or a Terminal Server Node to an Enterprise Terminal Server.
 

As a temporary workaround, users can connect by SSH protocol and child servers or nodes can be added by specifying SSH as protocol (by default NX protocol is used):

nxserver --serveradd <server> --protocol SSH
nxserver --nodeadd <node> --protocol SSH