Trouble with NATO "user enabled" alert

I cloned the NATO5 "User Account Disabled" alert rule and got the alert to fire and an email notification working very quickly and easily.

Now I am trying to do the same with "User Account Enabled", and cannot get the alert to fire.  Does anyone have any ideas about what to check?  The rule is saved, checks as "ok", is enabled, and the rules are activated.  I even see 4722 events on my domain controllers, but I never see the event fire in  LEM --> Monitor --> Rule Activity.

Thanks,

Craíg