Either one, as long as both as connected to the domain. The changes it invokes are made to Active Directory not to the computer where it is run so it's more important who runs it (must have privileges to manage SPNs in AD) not where it is run.