You fix this by going to the device or server that serves up your VPN tunnel and "[modifying] the ISAKMP settings to only allow secure encryption algorithms to be negotiated." It probably allows weaker encryption options to be used for legacy support, so you turn that off. It's really starting to sound like you're way out of your depth with this client, honestly.
Not that I want to sound like too much of dick or parrot back the question information at you, but it's really as simple as changing the settings on your VPN tunnel to enforce stronger crypto (more modern algorithms and/or longer keylengths). This might even be as simple as disabling support for DES, which is a common standard from many years ago, that's incredibly insecure now.
It doesn't seem like this would would be found on your SBS/Exchange server (though I've seen stranger things), and I'd suggest looking at the routing gear first, in particular, any firewall or edge equipment that might be being used as the connection point for VPN users, where the VPN tunnel would be negotiated.