Normally when you set up Kerberos for IIS, you would do something like
setspn -A HTTP/machine some_account. When IIS 7 is installed, it registers the SPN "HOST/machine" for its kernel-mode authentication. Why does this work? Is "HOST" some kind of catch-all SPN that matches when there is no protocol-specific (e.g. "HTTP") SPN registered? Because the client will still specify the HTTP SPN in its TGT requests, right?
(Sorry if this is a simple question, "HOST" is a predictably difficult term to google)