in reply to Eventlog Category for NTDS?

Have you tried supplying the full pathname to the log of interest? SAy:

$handle=Win32::EventLog->new("C:\\Windows\\System32\\winevt\\Logs\\NTD +S.evt")

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
"Science is about questioning the status quo. Questioning authority".
In the absence of evidence, opinion is indistinguishable from prejudice.