Problem with integrated security without a domain over certain urls

A customer's been happily using some .Net code of mine for about 3 years. Now he's moved to a new server (cutting costs), and is no longer using a domain. All users are created as local users on the server. No proper DNS other than that provided by a broadband router.

I'm using identity impersonation and windows authentication to pick up the user's name - all simple enough.

The application is pretty simple, it just picks up the user's name, stuffs it into a parameter in a Crystal Report, then displays the report.

I can connect successfully via:
https://APPSERVER/CrystalWeb and https://localhost/CrystalWeb
and everything works fine.

However, they want to connect using their existing certificate, and external users need to connect too. To achieve that internally, I've added an entry to the HOSTS file.
When I connect via:
https://fred.domain.co.uk/CrystalWeb or https://192.168.x.y/CrystalWeb, the user initially authenticates correctly and their name is shown.
When I try to display the report, I get an error because Crystal tries to save a file in the temp folder. I've run Process Monitor, and the line where the file fails is identical to the line where it previously had succeeded. That is, impersonation is correct (my user name), and using the same app pool.

Any ideas?

Thanks