SpnManager/coverage:3
Kerberos broken now? →
coverage

An unreached host is never clean.

A host that was never audited has zero findings by definition. Reporting that as clean is the single most dangerous thing an audit tool can do. The forest coverage ledger treats "we could not reach it" as its own verdict and puts the number first.

the three dispositions
CLEAN
FINDINGS
UNREACHED
CLEAN

Audited, no findings

The host was reached, every selected provider ran, and no rule tripped. This is the only disposition that may be read as clean.

FINDINGS

Audited, with findings

The host was reached and at least one rule tripped. Findings carry severity, evidence, and a hand-off.

UNREACHED

Never audited

Offline, access denied, WinRM blocked, name did not resolve, or out of scope. Zero findings, and the report says so rather than folding it into clean.

Illustrative proportions. The ledger reports its own numbers per run.

how the number is reported

Invoke-SpnForestAudit takes an explicit computer list. Every name on the list ends in exactly one disposition, and the ledger header shows all three counts before any finding. A report whose unreached count is not zero is not a clean report, whatever the findings column says.

The reason for each unreached host is recorded so the second run can be targeted at the gap instead of repeating the whole scan.

forest coverage ledger (sample counts are placeholders)
Invoke-SpnForestAudit -ComputerList (Get-Content .\hosts.txt) -GenerateReport  hosts listed        {{ tok.SAMPLE_N }}  audited, clean      {{ tok.SAMPLE_N }}  audited, findings   {{ tok.SAMPLE_N }}  unreached           {{ tok.SAMPLE_N }}   ← not clean  unreached detail    fs-old-02      name did not resolve    app-legacy-07  WinRM: access denied    sap-qa-01      offline

why this is the design

Audit tools are judged on what they find. The incentive is to show a short findings list, and the easiest way to shorten one is to skip the hosts that are hard to reach. SpnManager makes the skipped hosts the loudest line on the page.

This also changes what "done" means for an audit: not zero findings, but zero unreached.