Remote resources? If using Kerberos, there are a few caveats to get that working correctly. For an IIS computer to impersonate a user when accessing remote resources, it needs to generate a delegation-level token for the user.
If the application pool is running under a custom identity (it usually is in these scenarios), the account needs to have the ability perform unconstrained delegation. On the account Delegation tab in Active Directory Users and Computers, select "Trust this user for delegation to any service (Kerberos only)".
If you don't see the Delegation tab, it means an SPN has not been assigned to the account. That needs to be corrected first using the setspn.exe command.
The IIS identity account needs to have the "Act as part of the operating system" privilege (SetTCB privilege) on the IIS server(s).
Download the Delegation Configuration tool and add that as an application on the web site. It lets you browse to the application url and generate a report that determines if delegation is configured correctly.
It's also very easy for the code to check the token type to determine if it is a delegation token or not, and log that information to a file.
Summary (Kerberos Protocol Transition and Constrained Delegation)
How To: Use Impersonation and Delegation in ASP.NET 2.0