Make sure they meet the qualifications for using Kerberos and if the problem persists, then run a Kerberos and NTLM trace to find out why it's defaulting to NTLM. You can find everything you need here: http://sqlsoldier.net/wp/sqlserver/advanced-troubleshooting-week-at-sql-university-lesson-3