I realise this might be a non SharePoint question but it might have been one that someone has encountered. I have a customer site that has a component (custom code) that use AD Kerberos delegation to work and its not for this particular site. I have found that there is a number of Kerberos errors in the event log: 

    Error Code: 0x7  KDC_ERR_S_PRINCIPAL_UNKNOWN
    
    The target name used was HTTP/portal.fqdn.blah This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server.

I have also discovered that there is a duplicate account registered for http/portal and its fqdn variant;

A check with setspn -x reveals:

    setspn -X
    Checking domain DC=domain,DC=sub
    
    Processing entry 6
    
    http/portal is registered on these accounts:
            CN=account1,OU=Accounts,OU=subou,DC=domain,DC=sub
            CN=account2,OU=Accounts,OU=subou,DC=domain,DC=sub
    found 2 groups of duplicate SPNs.

I attempted to unregister account1 and by doing this I couldn't even authenticate against the site, it almost seems as though it is the primary service account registered for http/portal.. I'm not entirely sure how to progress but I know that really it should only be 1 account registered for http/portal