In PowerShell we can use Get-GPRegistryValue cmled to identify the registry key(s) associated with:
More information about Get-GPRegistryValue can be found on this link:
For Enabled we get:
Specifies commands configured by the administrator for custom logging. These commands will run in addition to default log commands.
At least Windows Server 2008 R2 or Windows 7
For Disabled we get:
Delete the specific key created.