You need to ensure that User1 can view the events in the security event log