IIS 7 has a new feature called Kernel Mode Authentication, it can be found off "Advance Settings.."
In order for
SharePoint to use
Kerberos authentication, it has to be disabled:
(update 04/01/2010: sharepoint 2010 disable this by default!!)
This is necessary because Kernel Mode can't work with multi-server sysem where you can't register same SPN to multiple server accounts.
see here for IIS authentication negotiation process
NONONO In IIS 6, as long as NTAuthenticationProvider is set as "Negotiate, Kerberos", whether SPNs are registered or not, server granted Kerberos authentication. But IIS 7 seems to be of SPN awareness during negotiation regardless of Kernel Mode on or off: it only agree on Kerberos when the App Pool ID account has SPN registered, otherwise it falls back to NTLM.
In order for SharePoint to use Kerberos authentication, it has to be disabled: (update 04/01/2010: sharepoint 2010 disable this by default!!)
