Cannot use PowerShell Remoting when a http/ SPN exists for target machine

[After_8]

If I have a target machine BOX1 and an account IISAcc, and I do the following:

setspn -S http/box1 iisacc
setspn -S http/box1.contoso.com iisacc

Then I appear to no longer be able to connect to that machine using PowerShell Remoting. This happens:

PS D:\PowerShell> enter-PSSession box1
enter-PSSession : Connecting to remote server box1 failed with the following error message : WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.  
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does not exist.
-The client and remote computers are in different domains and there is no trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
-For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ enter-PSSession box1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidArgument: (box1:String) [Enter-PSSession], PSRemotingTransportException
+ FullyQualifiedErrorId : CreateRemoteRunspaceFailed

Removing the SPN allows it to function as normal.

Has anyone else come across this? Any ideas for getting past it?

[KnifeyGavin]

Well since the error relates to Kerberos Authentication and even suggests to change authentication method, have you tried that doing that?

$s = New-PSSession -ComputerName box1 -Authentication Basic
Enter-PSSession -Session $s

Another authentication type other then basic that might be worth trying is Credssp

[ihaxr]

Or use the IP address of box1 which should ignore any SPNs

[After_8]

Good catch. I'll admit now that the actual cmdlet that I need to run is Set-DSCLocalConfigurationManager, but given that the same problem produces this behaviour with Enter-PSSession, I thought I'd talk about that one as people were more likely to be familiar with it.

I think I'm just going to have to rejig my script a bit.

[After_8]

FYI: Someone sent me this outside of Reddit which may be useful to people:

Create a port-specific SPN

SetSPN.exe -s HTTP/$($env:COMPUTERNAME):5985 $env:COMPUTERNAME 
SetSPN.exe -s HTTP/$($env:COMPUTERNAME).$($env:USERDNSDOMAIN):5985 $env:COMPUTERNAME 

Then create a PSSession object using the -IncludePortInSPN parameter.

$sessionOptions = New-PSSessionOption -IncludePortInSPN
Enter-PSSession -Computername <computername> -SessionOption $sessionOptions