Kerberos authentication problem involving outlook2k3 & exchange2k3

Here is my situation:
We have a win2ksp4 DC, a win2ksp4 exchange2k3sp1 server, and win2ksp4 workstations with office2k3.

After I depromoted a DC (last month) many users began to complain about outlook being “offline”.  The new DC security template was set to only accept NTLMv2 so I went about switching all of the outlook settings to use Kerberos to authenticate.

Things seemed to work fine, though I turned the DC security setting back down to “use LM, NTLM, and NTLMv2 if negotiated” to troubleshoot a RAS\VPN authentication issue (still set this way).

Then I stumbled upon an outlook issue while trying to make an outlook rule/alert.  Outlook said I couldn’t do this while “offline” though the outlook connection icon confirmed that I was online.  No other outlook features seem to be compromised.  I experimented with the outlook authentication settings and found that when outlook was set to use NTLM the rule/alert feature worked, but with Kerberos it wouldn’t.

I noticed the outlook connection status was different depending on the outlook authentication setting.

using kerb:
server name                                   type                        status
exchangeserver                          directory                   disconnected
exchangeserver                          directory                   disconnected
exchangeserver.domain.local           mail                       established
exchangeserver.domain.local           mail                       established
exchangeserver.domain.local           mail                       established
--------
With ntlm and kerb (or just ntlm):
server name                                   type                        status
dcserver.domain.local                    directory                  established
dcserver.domain.local                    directory                  established
exchangeserver.domain.local           mail                       established
exchangeserver.domain.local           mail                       established
exchangeserver.domain.local           mail                       established
-------

I turned on kerberos logging on the client and observed that when I log on I get a single:
Event ID:          594 KDC_ERR_PREAUTH_FAILED 0x18

Followed by many of the following that appear each time outlook tries to authenticate:
Event ID: KDC_ERR_S_PRINCIPAL_UNKNOWN 0x7
Server Realm: DOMAIN.LOCAL
Server Name: krbtgt/DOMAIN.LOCAL
Target Name: exchangeAB/dcserver.domain.local@DOMAIN.LOCAL

These errors appear in sets of 3 that alternate target names exchangeAB/dcserver.domain.local@DOMAIN.LOCAL, exchangeAB/exchangeserver.domain.local@DOMAIN.LOCAL, and exchangeAB/EXCHANGESERVER@DOMAIN.LOCAL

(I can't find anything on this exchangeAB service!  setspn -L doesn't list it on the dc or the exchange)

last there is a reoccuring event on the exchange server that may be related:
Event Source: MSExchangeSA
Event ID: 9188
Microsoft Exchange System Attendant failed to read the membership of group 'cn=Exchange Domain Servers,cn=Users,dc=domain,dc=local'. Error code 'c0072030'.  “Please check whether the local computer is a member of the group. If it is not, stop all the Microsoft Exchange services, add the local computer into the group manually and restart all the services.”

I checked the "Exchange Domain Servers" group and the exchange server is definatly in there.

thanks in advance to anyone that can help me troubleshoot this kerberos curiosity,