Is IIS running on a different box than SQL (but part of the same Active Directory Forest)? If so, then in order to use Windows Authentication you need to allow the IIS box to impersonate users (it is a right that is granted to the computer account through Active Directory Users and Computers tool).
Setup a share on the SQL box (just for testing that users can access it). Allow Everybody read. Can the users access the share? If not then you may have other issues with AD and users
David Lundell
Principal Consultant and Trainer
www.mutuallybeneficial.com