Well, the admin ref manual says you can do it with:   ENABLE  EVENTS
NTEVENTLOG  ANR1596

(note you leave the I off ANR1596I).

I've never done ENABLE with the EVENTLOG, just with SNMP (and on AIX, at
that).  So I don't know if there is stuff you have to do in Windows.
ANyway, check out the commands ENABLE EVENTS, BEGIN EVENTLOGGING and END
EVENTLOGGING in the Admin ref, that's where you start.

************************************************************************
Wanda Prather
The Johns Hopkins Applied Physics Lab
443-778-8769
wanda_prather AT jhuapl DOT edu

"Intelligence has much less practical application than you'd think" -
Scott Adams/Dilbert
************************************************************************