When you disable the kernel-mode authentication option in IIS 7, make sure you will do an IISReset. Recycling the app pool is not enough. I was doing some debugging/testing with a WCF service using basicHttpBinding with a TransportCredentialOnly security...