After a bit of research and some further testing I have found the answer.  The Dial-in Tab in computer properties is not part of wk2 AD so I needed to upgrade the schema to w2k3 Secema using adprep.exe.  Now machine authentication is working.  The same configuration supports WPA2 AES if you install the wxp patch for wpa2.

I have configured the wireless client WPA-TKIP with 802.1x PEAP MS-CAHP-V2 and Server Certificate and IAS on W2K and I can authenticate with user credentials fine, but when I enforce machine authentication on the client.  The event log sees the computer authentication request but it is denied.  Resultant message: the computer ...