We have a daily report which reports on event 644 occurences (Windows user locked out).  For some reason our report contains duplicate entries for the same user. 

 

* It has the same time stamp

* It is from the same source server

 

This is an intermittent issue.  Can anyone advise on why this occurs?