Why does a SPN on a different host cause a server to lose its trust? How should I fix it?

I have a brand new server image that loses its trust as soon as it's joined to the domain. I suspect it's because of the duplicate SPN I discovered using the LDAP version of this Powershell script

Powershell script

#Set Search
cls
$search = New-Object DirectoryServices.DirectorySearcher([ADSI]“”)
$search.filter = “(servicePrincipalName=*)”
$results = $search.Findall()



#list results
foreach($result in $results)
{
       $userEntry = $result.GetDirectoryEntry()
       Write-host "Object Name = " $userEntry.name -backgroundcolor "yellow" -foregroundcolor "black"
       Write-host "DN      =      "  $userEntry.distinguishedName
       Write-host "Object Cat. = "  $userEntry.objectCategory
       Write-host "servicePrincipalNames"
       $i=1
       foreach($SPN in $userEntry.servicePrincipalName)
       {
           Write-host "SPN(" $i ")   =      " $SPN       $i+=1
       }
       Write-host ""

} 

Host with duplicate SPN

dn: CN=NYC01IMFE02,CN=Computers,DC=hp,DC=com
changetype: add
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:52407
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:LYNCLOCAL
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:59066
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:RTCLOCAL
servicePrincipalName: http/nyc01imfe02.hp.com
servicePrincipalName: sip/nyc01imfe02.hp.com
servicePrincipalName: TERMSRV/NYC01IMFE02.hp.com
servicePrincipalName: TERMSRV/NYC01IMFE02
servicePrincipalName: WSMAN/NYC01IMFE02
servicePrincipalName: WSMAN/NYC01IMFE02.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01IMFE02
servicePrincipalName: HOST/NYC01IMFE02
servicePrincipalName: RestrictedKrbHost/NYC01IMFE02.hp.com
servicePrincipalName: HOST/NYC01IMFE02.hp.com
servicePrincipalName: TERMSRV/NYC01EXCAS04
servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com
servicePrincipalName: HOST/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04
servicePrincipalName: HOST/NYC01EXCAS04

Host I just created

dn: CN=nyc01excas04,CN=Computers,DC=hp,DC=com
changetype: add
servicePrincipalName: WSMAN/NYC01EXCAS04
servicePrincipalName: WSMAN/NYC01EXCAS04.hp.com
servicePrincipalName: TERMSRV/NYC01EXCAS04
servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04
servicePrincipalName: HOST/NYC01EXCAS04
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com
servicePrincipalName: HOST/NYC01EXCAS04.hp.com

Question

1. What would cause these entries to be located on the wrong host?

.

servicePrincipalName: TERMSRV/NYC01EXCAS04
servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com
servicePrincipalName: HOST/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04
servicePrincipalName: HOST/NYC01EXCAS04

2. What is the meaning of those entries? What are they used for

3. Would they have caused a trust failure in the new machine? Why is it that only one machine has issues, and not the other

4. How do I correct the issue?

Basically, setspn in a proper functioning AD shows no duplicates. I think you should remove 'em at least for the troubled machine. Start with the troubled machine SPN's which miss the realm part.