$logname = "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController" $log = Get-WinEvent -ListLog $logname $log.IsEnabled = $true $log.SaveChanges() $logname = "Microsoft-Windows-Authentication/ProtectedUser-Client" $log = Get-WinEvent -ListLog $logname $log.IsEnabled = $true $log.SaveChanges()