Security-Kerberso Errors on some machine

Question

Hello,
The reason why i'm writing is because, recently we have seen some strange DFS issues, where clients aren't able to connect to their DFS mapped drives.  flushing DFS cache or DNS cache or rebooting client seems to fix issue.  We have also had
to reboot a DFS server, since it was hung in the past.  So, I have ticket open with MS and can't find any DFS related issues from event logs.
I see a Kerberos error in event logs on both DFS servers and some clients that have the issue and I"m wondering if this is the cause of problems.  Please see Kerberos error below and let me know what you think.  I want to also add that we
have direct access server and i'm seeing "isatap.ipv6address" when I run ipconfig on these servers and clients..
"The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server hq12-dfs2$. The target name used was HTTP/HQ12-DFS2.hhmi.org. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the
target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password
is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target
domain (HHMI.ORG) is different from the client domain (HHMI.ORG), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server."

Answer 1

They basically want me to enable all Kerberos encryption types and then disjoin/join my DFS servers from domain.  I"m doing it tonight, so we will see what happens.  I actually haven't had the DFS issues, since I posted this question in forum. 
I will still implements their recommendations.
Step 1: adjust the supported Kerberos etype
====================================
a. Run GPMC on one 2008R2 DC or 2012R2 DC, Edit Default Domain Policy.
b. Navigate to Computer Configuration\ Windows Settings\ Security Settings\ Local Policies\ Security Options\Network security: Configure encryption types allowed for Kerberos
We need to select Define these policy settings and all the six check boxes
c. After that, please run GPUPDATE  /FORCE to take effect. After it is done, please restart all the DCs after business hours.
Step 2: Disjoin and Rejoin DFS namespace servers to the domain (one by one)
==============================================
1. On HQ12-DFS2, please delete it from the namespace server first
2. Then, disjoin the server from the domain.
3. After a reboot, please rejoin the server into the domain
4. Add it into DFS namespace
5. Then, perform the above steps on HQ12-DFS1 again.