## 13.5.2.2.9  Security-Relevant Logging and Tracing
Windows Wordprocessor Integration (WWI) and Expert log all processing information in the Windows Application Event Log. A separate Security Log for WWI and Expert does not exist. For security relevant information from Windows, check the Windows Security Event Log.
For more information on maintaining a secure environment in Windows servers, check the Microsoft Windows Security Guide and the Microsoft Security Compliance Manager .
## Tracking Configuration Changes
To track configuration changes of WWI and Expert Server Administration that are executed by WWI and Expert Server Administration (transaction CGSADM ), enable the security audit log in the Security Audit (transaction SM19 ).
Relevant audit log numbers:
- DUA - EHS-SADM: Service &amp;A on client &amp;B created
- DUB - EHS-SADM: Service &amp;A on client &amp;B started
- DUC - EHS-SADM: Service &amp;A on client &amp;B stopped
- DUD - EHS-SADM: Service &amp;A on client &amp;B stopped
- DUE - EHS-SADM: Configuration of service &amp;A on client &amp;B was changed
- DUF - EHS-SADM: File &amp;A from client &amp;B transferred
- DUG - EHS-SADM: File &amp;A transferred to client &amp;B
For more information on configuration changes, change documents are used. Creating change documents in WWI and Expert Server Administration is enabled by default. To switch off the creation of change documents, set the environment parameter CGSADM\_NO\_CHANGE\_DOCS in the Specify Environment Parameters Customizing activity to X .
To display change documents, start the program RSSCD110 (Display change documents (cross-client)) and choose object class ESSADM .
## Tracking Configuration with Windows Features
To track WWI and Expert configuration changes, enable auditing in the Windows file system. For more information on Access Control and Security Auditing, see the Windows Help.
Before setting up auditing for files and folders, enable object access auditing by defining auditing policy settings for the object access event category.
To define or modify auditing policy settings for an event category for your local computer, proceed as follows:
1. Choose Control Panel Administrative Tools Local Security Policy.
2. In the console tree, go to Local Policies Audit Policy.
3. 3.In the results pane, choose Audit object access to enable the auditing policy settings.
To configure auditing settings for a local file or folder, proceed as follows:
1. Open Windows Explorer .
2. In the context menu of the file or folder that you want to audit, choose Properties and go to the Security tab page.
3. Choose Edit , and then choose Advanced.
4. In the Advanced Security Settings go to the Auditing tab page.
To configure auditing settings for a registry key:
1. Open Registry Editor .
2. Go to the registry key.
3. In the context menu of the registry key that you want to audit, choose Permissions .
4. On the Security tab page, choose Advanced .
5. In the Advanced Security Settings , choose the Auditing tab page.
## Windows Wordprocessor Integration (WWI)
For WWI, the following files and folders must be covered by change auditing:
- WWI.INI
- SAPRFC.INI
- GRAPHICS
- Registry key: HKEY\_CLASSES\_ROOT\WWIDOCUMENT
## Expert
For Expert, the following files and folders must be covered by change auditing:
- SAPRFC.INI
- RULES
- Registry key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Wow6432Node\TechniData\EHSAddOns\Instances
For 32bit systems, omit Wow6432Node
- Registry key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Wow6432Node\TechniData\EHS-AddOns\Systems
For 32bit systems, omit Wow6432Node