Answer by Kirk Liemohn for Impersonation and Delegation

For one of our applications where we did Impersonate() we found that we had to modify the local security policy for the application pool owner and add that account to the following policies/groups:

1. Act as part of the operating system privilege.
2. Impersonate a client after authentication.

On the server(s), run Start > All Programs > Administration Tools > Local Security Policy then navigate to Local Security Policies > User Rights Assignment and look for the two policies above.