We are trying to replace a SSP with a new one. To transfer user
profiles from the old SSP, we are using the User Replication Engine
from tOolkit 2.0. When we tried to refresh the Change Token, we get
the error "cannot get change token". Our farm consists of 3 web
servers, 1 central admin host, 1 index, 1 query and an ISA 2006
server. I have 4 SSPs in this farm and I have 4 mysite hosts (1 per
SSP). I tried all mysite hosts as the source URL and I got the
same error. No error is logged in th event logs, in the Sharepoint
logs nor in the toolkit's log. Our sites are accessible via SSL and I
tried using http or https.

I started the Replication Engine in the Services console before
running the engine and this error cama back in the event log:
event source: RE IncrementalReplicator event ID: 3313
Error on the pull from <source mysite>
destination server <destination mysite>
System.Net.Exception: The request failed with HTTP status: 401
Unauthorized at System.Web.Services...

The account I'm using has "Manage Profiles" right on both SSPs and
has local admin to the central admin host where I'm running the
engine from. It's actually the same account I use to do the daily
profile import from AD.

It looks like the account is attempting to use the web service but
has no proper credentials?