I've done what I thought would be the hard part. I've located the source of the duplicate SPN, and it's a bad entry for one of my DC's. I see it in ADSIEdit, but it's only listed when I connect on port 3268, which is the GC port. However, when I try to delete the duplicate entry, I get: "Operation failed. Error code: 0x2035 The server is unwilling to process the request. 00002035: LdapErr: DSID-0C0909B0, comment: Operation not allowed through GC port, data 0, v1db0" If I can't delete it through the GC port, how can I delete this duplicate entry when it's not found by any other method I've tried?

I was finally able to fix this using the repadmin /removelingeringobjects command, with help from this page: http://technet.microsoft.com/en-us/library/cc794840(WS.10).aspx