I've also tried granting SPN (service principal name) on the user account and server running FTP, no luck.
I enabled account logging on the FTP server and got a LOGON TYPE 8 failure, which can't send the password across the network as clear text. It looks like w2k8 locks down this setting. I don't know right off which one in the local or domain security policy, but that appears to be a legitmate lead. Hope this helps.
Here is the error i got on the ftp server.
Logon Failure:
Reason: An error occurred during logon
User Name: steve@ss.local
Domain:
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: W2K3-1
Status code: 0xC003000C
Substatus code: 0x0
Caller User Name: W2K3-1$
Caller Domain: SS
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1220
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.