I have got weird problem. Even though rsop.msc on win7(professional-ultimate) workstations is showing that the "manual start" policy for this service is applied, it starts automatically on reboot and each time gpupdate /force is done. All the rest of policies (and I really mean ALL) are applied just fine.

Oh this clarifies everything. Thank you. Should I try another secure channel protocol maybe ?