In order to allow Windows XP SP2 or Windows Server 2003 SP1 to talk to a remote MSDTC located in a cluster, the security level for MSDTC needs to be set to "Incoming Caller Authentication Required". (see http://blogs.msdn.com/florinlazar/archive/2004/06/18/159127.aspx
