Only User failed to authenticate through Kerberos logon events are audited and returned in a search (4300334)

When searching for logon activity only 'User failed to authenticate through Kerberos' events are visible.

There are not any successful 'User authentications through Kerberos' events being audited. 

Checking the ‘Audit Logon events’ audit policy for all servers and workstations, the policy is set for Success.

Perform the following steps to enable this event class:

1. Open the Client | Administrative Tasks tab | Select Auditing in the lower left corner | Select Audit Events at the top of the left hand panel.
2. Locate the "User authenticated through kerberos" event in the list
3. To enable, click the drop-arrow next to "Disabled" and change the Status to "Enabled".