- Check the SPNs of the client end point inside the wcf configuration file. Make sure that the destination endpoint is defined correctly.
- This can be caused by requiring kerberos authentication where is it not possible. In this case make sure that allowntlm is enabled for the particular service.
- Keep in mind that Kerberos caches the SPN tickets. Purge them on all machines when making a change to them.
- Restart the app pools in IIS and restart the services after doing klist purge.
- Sometimes a IISReset is also required.