Earlier quoted context omitted.
Effectively this is done as a POC, don't expect any security on a machine running Windows 2000 nowadays. Regarding legality, I hope that Microsoft doesn't claim any rights, since the Windows 2000 image has been published in WinWorld for years without issues.
Careful with your claims. What is the supply chain of that win2k iso? You could be compromised before you even begin. Just because it is past EOL doesn’t mean you chuck all security best practices out the window. “Oh well it’s end of life, might as well store passwords in plaintext” Microsoft still owns copyright on Win2k, so you could be met with a cease and desist or you could be liable for infringement.
Some other comments mention browsing with IE5. You should expect that to provide no security either.