solutions by scenario

Seven estates, and what happens in each.

Each scenario names the providers involved, what the product does, and what it declines to do.

SQL.Engine

situation: Availability group with a listener. Nodes have SPNs; the listener FQDN was forgotten. Some clients land on Kerberos, others fall back.
it does: Senses instances and ports per node, proposes FQDN and NetBIOS variants including the listener, tests for duplicates across nodes, proves with the SqlAuthScheme oracle.
it will not: Register anything on a node machine account when the service runs as a domain account.

AD.SharePointSQL.Engine

situation: Multiple web applications, several app pool accounts, alternate access mappings, Central Administration on its own port.
it does: Enumerates web applications and AAM URLs, groups by app pool account, includes Central Administration, tests, executes or hands off. Delegation chain to MSSQLSvc reported by the KCD audit.
it will not: Guess AAM URLs that are not configured, or write SPNs for a farm whose PSConfig account it cannot resolve.

AD.LinuxJoinedAudit.KeytabDrift

situation: Hosts joined with realmd, sssd, or adcli. Computer objects exist. Some renamed, some rejoined, some with stale keytabs.
it does: Audits HOST/ and HOST/ on each computer object, flags stale old-FQDN SPNs, cross-references possible keytab skew, emits a runbook naming adcli update or net ads keytab add and the service restart.
it will not: Read, write, or hold /etc/krb5.keytab. Write the AD-side SPN as if that fixed the host.

AD.JavaSpnego

situation: Tomcat, JBoss, WildFly, or Hadoop web front-end authenticating from a keytab mapped to a service account.
it does: Finds the account carrying HTTP/, reports the AD-side gap including missing NetBIOS variants and vhost CNAMEs, emits a runbook for keytab regeneration at the matching KVNO.
it will not: Regenerate the keytab. Model per-daemon Hadoop principals it cannot verify; those are handed off.

AD.ApplianceSsoAudit.KCD

situation: F5 BIG-IP APM, Citrix NetScaler/ADC, or KEMP LoadMaster doing KCD to a back end. Not domain-joined; a delegation account holds HTTP/.
it does: Discovers the delegation account by SPN search, audits msDS-AllowedToDelegateTo, reports duplicates on the VIP name, emits a runbook for the vendor-side SSO config.
it will not: Touch the appliance. Treat the AD-side write as a fix when the appliance config was not regenerated.

AD.OracleDb

situation: Single-instance Oracle with the Kerberos adapter; oracle/ on a service account; sqlnet.ora holds the keytab path.
it does: Audits the oracle/ holder, reports the gap, emits a runbook covering keytab regeneration and listener restart. RAC/SCAN fan-out is named in the runbook, not guessed.
it will not: Model RAC/SCAN principals it has not verified. Read or write the keytab.

AD.SAPAudit.EncryptionTypes

situation: NetWeaver AS Java or Fiori web SSO plus SAP GUI/RFC via SNC; AES required.
it does: Audits the HTTP and SAP legs on the service account, checks enc-type posture, emits a runbook for the SNC gss config and instance restart. The SAP/ format is marked advisory pending confirmation against the current SAP note.
it will not: Claim the SNC principal format is verified. Prove the GUI/RFC leg, for which no in-house oracle exists.