I love this site, and I often check the Download -> OS Update section to see if there are new updates for my Windows 2000 system.

It makes sense that you should apply SP3 before anything else and then of course post SP3 fixes when updating a new Windows 2000 install, but why do you recommend old security related fixes etc. to be applied in between? Like "Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard" (Updated 29/08/2001).
I thought they were included in SP3? I am not sure I fully understand the order of the updates. Could someone please clarify.

I think you will find that if you visit windowsupdate.microsoft.com before and after a service pack 3 install (just to examine what it offers, not to install anything), the after visit will yield far less offered downloads. I just did this today at work so I am pretty sure.

Therefore I would apply the service pack and then see what updates remain.

Hi, I'll look into this again. For the most part though I remove all the unneeded updates after a service pack or other cumulative patch is released. I don't believe that patch was included in service pack 3. I'll check the fix list for SP3 to see if its listed, though generally if it is listed it won't be on the list.