SQL or Permission problem?

Hi,
I am looking after a tiered system which has two IIS servers connecting to a SQL server.

I also changed the NTFS permissions on the servers through a GPO recently (which ties in to the problem start date) where I overwrote settings instead of appending them.

From the website test the MSDTC fails to communicate. I've checked the settings in the DCOM, System, MSDTC, Security settings and they are correct.  I have also ran sc sdshow and got the following response:
D:(A;;CCLCSWRPLOCRRC;;;S-1-2-0)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOC
RSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPRC;
;;WD)(A;;CCLCSWRPLORC;;;NS)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

This is consistant on all 3 servers and another server in a different environment which does work so I presume this is OK?

I am also getting a number of event logs (full auditing on fail is on) like this:
Event Type:      Failure Audit
Event Source:      Security
Event Category:      Object Access
Event ID:      560
Date:            11/12/2008
Time:            14:24:46
User:            DOMAIN\SERVICE ACCOUNT 1
Computer:      COMPUTERNAME
Description:
Object Open:
       Object Server:      SC Manager
       Object Type:      SC_MANAGER OBJECT
       Object Name:      ServicesActive
       Handle ID:      -
       Operation ID:      {0,184791139}
       Process ID:      716
       Image File Name:      C:\WINDOWS\system32\services.exe
       Primary User Name:      COMPUTERNAME$
       Primary Domain:      DOMAIN
       Primary Logon ID:      (0x0,0x3E7)
       Client User Name:      SERVICE ACCOUNT1
       Client Domain:      DOMAIN
       Client Logon ID:      (0x0,0x7670151)
       Accesses:      READ_CONTROL
                  Connect to service controller
                  Enumerate services
                  Query service database lock state
                  
       Privileges:      -
       Restricted Sid Count:      0
       Access Mask:      0x20015

This error occurs when the tests are run which would indicate some of the problem.  This error only started after my permissions error.

The system test fails on MSDTC Write Test. See error log below.

Reference Number 081211165707-7 Session ID = 8fac38e1-272a-4b24-9a5a-7caa202a213c Insight Exception Occurred:

Communication with the underlying transaction manager has failed.

   at System.Transactions.TransactionInterop.GetOletxTransactionFromTransmitterPropigationToken(Byte[] propagationToken)
   at System.Transactions.TransactionStatePSPEOperation.PSPEPromote(InternalTransaction tx)
   at System.Transactions.TransactionStateDelegatedBase.EnterState(InternalTransaction tx)
   at System.Transactions.EnlistableStates.Promote(InternalTransaction tx)
   at System.Transactions.Transaction.Promote()
   at System.Transactions.TransactionInterop.ConvertToOletxTransaction(Transaction transaction)
   at System.Transactions.TransactionInterop.GetExportCookie(Transaction transaction, Byte[] whereabouts)
   at System.Data.SqlClient.SqlInternalConnection.EnlistNonNull(Transaction tx)
   at System.Data.SqlClient.SqlInternalConnection.Enlist(Transaction tx)
   at System.Data.SqlClient.SqlInternalConnectionTds.Activate(Transaction transaction)
   at System.Data.ProviderBase.DbConnectionInternal.ActivateConnection(Transaction transaction)
   at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)
   at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)
   at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
   at System.Data.SqlClient.SqlConnection.Open()
   at VENDOR.Insight.DataAccess.DBAccess.RunNonQueryCommandWithResult()
   at VENDOR.Insight.DataAccess.DBAccess.RunCommandWithResult()
   at VENDOR.Insight.DataAccessComponents.DACClient.SaveFromEntity(BEClient entity, String sessionID, Boolean insert)
   at VENDOR.Insight.DataAccessComponents.DACClient.Create(BEClient entity, String sessionID)
   at VENDOR.Insight.BusinessComponents.BCClient.SaveClient(BEClient entity, String userID, String sessionID)
   at VENDOR.Insight.BusinessWorkflows.BWClient.InternalSave(BEClient client, String userID, String sessionID)
   at VENDOR.Insight.BusinessWorkflows.BWClient.Save(BEClient client, String userID, String sessionID)


Reference Number 081211165707-8 Session ID = 8fac38e1-272a-4b24-9a5a-7caa202a213c Insight Exception Occurred:

Test Error - Raised by testing the system

Event logs on the SQL server are not showing anything in the same time period which could indicate the problem, nor the Services IIS server. The Internet IIS server appears to be the problem server (event log anyway).

I'm wondering if the Network Service account should have access to something it currently doesn't have, but I can't figure out what.  That is what the MSDTC is using.

I do have alternative environments to compare the settings against, there are just a lot of settings!

Any help appriciated.