When the Net Logon service prepares to write an event to the System event log, it first determines if the event is a continuation of a previous event. If the second event is identical to the previous event, and it occurs less than 2 hours after the previous event, it is considered to be a continuation and is NOT recorded.
NOTE: This function is designed to minimized the number of repeated entries in the System event log.
You can alter this behavior by using Regedt32 to Add Value name DuplicateEventlogTimeout, a REG_DWORD data type, at HKEY_LOCAL_MACHINE\\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters, and setting the data value to a Decimal number between 0 and 4,292,967.
NOTE: Setting DuplicateEventlogTimeout to 0 causes Net Logon to record all events.
