Is it possible to do delegation in a cross forest scenario with only a one way trust? I have 2 domains which are in different forests, and there is a one way trust from the resourcedomain to the userdomain. The SPN's are registered properly on the resourcedomain, but when trying to connect with a userdomain to a server in resourcedomain the protocol falls back to NTLM.
Which version of windows server you are using? If its Win2000 only NTLM/External is supported to do cross forest authentication. If its win2003 and if you have created Cross-forest trust then you should be able to use kerberos. Incase if its External trust it will only do NTLM.