OK, that makes sense. Yeah, once we click that button in AD for the user for AES 256, the SNC and SPnego cease to work. Same thing if we do AES128.
but klist command DOES show that the service ticket, which was previously RSADSI RC4-HMAC(NT) is now the AES-128 or 256.
Would you then say the problem is on the SAP side? If you agree, then I could trace that via SM50 and SE38 SEC_TRACE_ANALYZER.