here are two ways:

a) You need a console Adapter like this:
     http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10588
     
     Interesting commands on my TDS7xx scopes:

     libManagerWordAtPut(0x50006, 1) <- Enable option 1M
     libManagerWordAtPut(0x50007, 1) <- Enable option 05
     libManagerWordAtPut(0x50008, 1) <- Enable option 13
     libManagerWordAtPut(0x50009, 1) <- Enable option 2F
     libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
     libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
     libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
     libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
     libManagerWordAtPut(0x5000f, 1) <- Enable option 2M

b) Use a GPIB Adapter

I don't remember the exact syntax, but it should be:

PASSWORD "PITBULL"
WORDCONSTANT:ATPUT 327686,1

Where the decimal number (327686 in that case) is the same number as in the console-port-example above, just in decimal.

Note that you have to set the flash write protection switch to unlock to write those settings.