See if this will be of help
Copy the appropriate template file (Dwup.inf for Professional or Dsup.inf for server) from your Windows 2000 distribution share into the %WinDir%\Security\Templates folder on your local computer. It may be in unexpanded from in the I386 folder so you may need to expand it:
D:\I386>expand dwup.in_ dwup.inf
Microsoft (R) File Expansion Utility Version 5.00.2134.1
Copyright (C) Microsoft Corp 1990-1999. All rights reserved.
Expanding dwup.in_ to dwup.inf.
dwup.in_: 17285 bytes expanded to 252850 bytes, 1362% increase.
D:\I386>copy dwup.inf %windir%\security\templates
1 file(s) copied.
Start Microsoft Management Console (Start - Run - MMC).
From the Console menu select Add/Remove Snap-in, click Add, click Security Templates, click Add, click Close, and then click OK.
Expand the Security Templates root, then the templates folder. You will see your copied template, e.g. dwup.inf
Click the security area that you want to modify (Registry or File System).
In the result pane, a list of all of the registry keys or file system objects configured by the default upgrade template is displayed. Determine whether or not the object you want the upgrade to ignore is explicitly configured by the template, and then use one of the following:
1. Right-click Registry or File System, and then click Add Key or Add File.
2. Browse the dialog box to select the key or file system object you want to protect (for example, Machine\Software\DelOld). If the key, folder, or file does not exist on your computer, you can type the path to the object in the available box.
3. Click OK to start the Access Control List (ACL) editor.
4. Click OK again to accept the default security provided by the ACL editor.
5. Click Do not allow permissions on this key\file to be replaced.
6. Click OK to add the object to the template, and then go to step 7.
