How can I stop a Windows 2000 upgrade overwriting special security settings?

Copy the appropriate template file (Dwup.inf for Professional or Dsup.inf for server) from your Windows 2000 distribution share into the %WinDir%SecurityTemplates folder on your local computer. It may be in unexpanded from in the I386 folder so you may need to expand it:

D:I386>expand dwup.in_ dwup.inf
    Microsoft (R) File Expansion Utility  Version 5.00.2134.1
    Copyright (C) Microsoft Corp 1990-1999.  All rights reserved.

    Expanding dwup.in_ to dwup.inf.
    dwup.in_: 17285 bytes expanded to 252850 bytes, 1362% increase.

    D:I386>copy dwup.inf %windir%securitytemplates
        1 file(s) copied.

Start Microsoft Management Console (Start - Run - MMC).

From the Console menu select Add/Remove Snap-in, click Add, click Security Templates, click Add, click Close, and then click OK.

Expand the Security Templates root, then the templates folder. You will see your copied template, e.g. dwup.inf

Click the security area that you want to modify (Registry or File System).

In the result pane, a list of all of the registry keys or file system objects configured by the default upgrade template is displayed. Determine whether or not the object you want the upgrade to ignore is explicitly configured by the template, and then use one of the following:

If the object you want the upgrade to ignore is not explicitly configured by the upgrade template, you must add it using the following steps: 

1. Right-click Registry or File System, and then click Add Key or Add File.
2. Browse the dialog box to select the key or file system object you want to protect (for example, MachineSoftwareDelOld). If the key, folder, or file does not exist on your computer, you can type the path to the object in the available box.
3. Click OK to start the Access Control List (ACL) editor.
4. Click OK again to accept the default security provided by the ACL editor.
5. Click Do not allow permissions on this keyfile to be replaced.
6. Click OK to add the object to the template, and then go to step 7.

If the object you want the upgrade to ignore is already explicitly configured in the upgrade template, modify it using the following steps: 

1. In the result pane, double-click the object you want to protect.
2. Click Do not allow permissions on this keyfile to be replaced, click OK, and then go to step 7.
Click here to view image

In the result pane, the object you want the upgrade to ignore should now be listed with the Ignore property listed under both the permission and audit columns. Right-click the name of the template, and then click Save.

Copy the modified template back to the distribution share. If you had to uncompress the file recompact the file before copying back to the distribution share:

F:WINNTsecuritytemplates>compress dwup.inf dwup.in_
    Microsoft (R) File Compression Utility  Version 5.00.2134.1
    Copyright (C) Microsoft Corp. 1990-1999.  All rights reserved.

    Compressing dwup.inf to dwup.in_.
    dwup.inf: 251177 bytes compressed to 46002 bytes, 82% savings.