4.1.28.2.1 ExecuteWriteSPNRemotely

 procedure ExecuteWriteSPNRemotely(
     DWORD dwInVersion,
     DRS_MSG_SPNREQ *pmsgIn,
     DWORD *pdwOutVersion,
     DRS_MSG_SPNREPLY *pmsgOut): ULONG

This procedure is executed only on an RODC. It finds a DC that holds a full NC replica of the domain NC of the RODC, performs the IDL_DRSWriteSPN RPC method call with the given parameters against the DC in the client's security context, and returns the value returned by that RPC call.