Questions with short answers.

Does it write to Active Directory?

Six providers can, behind -WhatIf and -Confirm and a preflight rights check. Everything else reads, compares, reports, and hands off. See the safety model.

Does it ever touch a keytab?

No. It never reads, writes, exports, regenerates, or holds a keytab or any secret. For keytab services it emits a runbook.

Why is my proof run Inconclusive?

The baseline was already Kerberos. An SPN may have pre-existed and the run proved nothing about the change. That is the correct verdict.

Why does the report show hosts as Unreached instead of leaving them out?

Because a host that was never audited has zero findings by definition, and reporting it as clean would be false.

Which PowerShell versions?

5.1 and 7.

Does it replace setspn?

No. It wraps setspn -X for the duplicate scan and emits setspn bundles as its hand-off. See why not just setspn.

Is SQL Server special?

SQL Server is provider 0: the first one built, ported from SqlSpnManager. It is one of 26 providers now.

Can it prove SAP or appliance SSO end to end?

No, and it says so. The SNC leg and the appliance-to-back-end leg have no in-house oracle; those providers are audit-only by constraint.

Has it shipped?

Not yet. Version 0.4.0. It will be sold through Azure Marketplace and AWS Marketplace.

Is there an install base or customer list?

None is published.

How do I report a bug or a security issue?

Bugs: Support →. Security: Vulnerability disclosure →.