The accounts were initially entered into PAM without the domain, and after being put into sync @domainname.com was added, and the account saved again. After upgrading to 3.2.2 doing this resulted in the error "PAM-CM-3431: Distinguished Name (DN) must be specified" being seen.
Citrix was modified to create Domain specific front ends. After doing this it was no longer necessary to add @domainname.com to the account name. This resolved the problem.