You may lose some events when you subscribe to some events that are in multiple event logs on a computer that is running Windows Server 2008 or Windows Vista
An application or service subscribes to some events that are in multiple event logs by using Windows Management Instrumentation (WMI) or Windows APIs on a computer that is running Windows Server 2008 or Windows Vista.
In this scenario, the application or service may miss some expected events. This issue causes function failure in the application or service.
For example, an application subscribes to an event to monitor the user accounts that are created. Because of this issue, some newly created user accounts are not detected by this application.
For more information on this issue, including potential causes, workarounds, and resolutions, see: Microsoft KB Article KB973995.