The computer processing / re-ACL-ing works fine, but joining the computer to the target domain fails, as it claims the computer object already exists in the target domain.
Error: 65 The SPN is already registered in the forest.
This is due to the fact that duplicate SPNs cannot exist in the same forest. SPNs are unique identifiers for the services running on the servers. Each service that uses Kerberos authentication needs to have an SPN set for it so that clients can identify the service on the network. It is registered in Active Directory attribute servicePrincipalName under a service account or computer account if service runs under the Local System Account. Any service or user can look up the SPN for another service. When they want to authenticate to such service, SPN is used to differentiate it from other services running in AD.
In order for these applications to work properly, the hotfix alters AD behavior via the dSHeuristics setting in Active Directory and allows the SPN uniqueness check to be bypassed.
dSHeuristics description: https://msdn.microsoft.com/en-us/library/cc223560.aspx
To check dSHeuristics value using get-adobject
