solved
edited the boot.ini per this kb doc
http://support.microsoft.com/kb/875352
To configure DEP to switch to the AlwaysOn policy by using the Boot.ini file, follow these steps:
Click Start, right-click My Computer, and then click Properties.
Click the Advanced tab, and then click Settings under the Startup and Recovery field.
In the System startup field, click Edit. The Boot.ini file opens in Notepad.
In Notepad, click Find on the Edit menu.
In the Find what box, type /noexecute, and then click Find Next.
In the Find dialog box, click Cancel.
Replace policy_level with AlwaysOn.
WARNING Make sure that you enter the text accurately. The Boot.ini file switch should now read:
/noexecute=AlwaysOn
In Notepad, click Save on the File menu.
Click OK two times.
Restart the computer.