The reason the computers will negotiate down to DES, representatives from Microsoft say, is to maintain communications with the remote machine. Computers configured with the High Encryption Pack will fail in their negotiation attempts and cause alerts in the application event log, notifying administrators. In our opinion, if it is not available, 3DES should not be selectable. End Points Security is greatly enhanced when applied to individual desktops. Insiders have a greater opportunity to employ passive means to gather information off the wire using analyzers.
Encryption obviously limits what can be gathered.
The two most scalable methods, Kerberos and certificates, require Active Directory. If the two computers are in the same domain or in a trusted domain, you can use Kerberos authentication. This is perhaps the easiest to implement and requires no management overhead, because authentication is based on existing user credentials. Understanding how certificates are used with IPsec VPN is important. Traditionally, certificates have been associated with end users.