Normally when I'm doing deployments, at some point Kerberos will turn around and bite me in the arse. Every time I think I'm getting the hang of this three-headed dog from hell, it surprises me again. The tool that's normally got me out of this hole is Brian Murphy's DelegConfig tool. Here's his blog site about it:
http://blogs.iis.net/brian-murphy-booth/archive/2007/03/09/delegconfig-delegation-configuration-reporting-tool.aspx
Anyway, recently Microsoft have rejigged their iis.net website and the download link on the blog page no longer works. Here is the new link:
http://www.iis.net/downloads/community/2009/06/delegconfig-v2-beta-(delegation-kerberos-configuration-tool)