Hi,
The log files are located in $Env:windir\System32\winevt\Logs. You can simply copy Microsoft-Windows-NTLM%4Operational.evtx to back up the entire log file.
Best Regards,
Ian Xue
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.