your flag file need to contain the flags --disable_events=false --windows_event_channels=Application,Security,System (whatever event channels you want)