win2k3 IAS Cisco 1100 PEAP problem

I'm having a problem getting a wireless XP SP2 computer to connect to a Cisco
1100 AP that is using IAS as its Radius server.

I've set things up according to the MS doc "Securing Wireless LANS with
PEAP..." and am getting the following error...

User ****\**** was denied access.
Fully-Qualified-User-Name = ****.local/Corp/****
NAS-IP-Address = *.*.*.*
NAS-Identifier = ap
Called-Station-Identifier = 0015.6399.ffc0
Calling-Station-Identifier = 0040.96a5.9f37
Client-Friendly-Name = Test
Client-IP-Address = *.*.*.*
NAS-Port-Type = Wireless - IEEE 802.11
NAS-Port = 435
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = Connections to other access servers
Authentication-Type = EAP
EAP-Type = <undetermined>
Reason-Code = 66
Reason = The user attempted to use an authentication method that is not
enabled on the matching remote access policy.


EAP-Type should be Peap as it's configured in IAS and on the XP laptop.

The Cisco is configured with TKIP, WPA using Open+EAP Auth.

Any ideas?