Workstation agent audit information is not being consistently written to the database for some machines. The events do appear in the User Logon Activity screen, but once Refresh is selected, some events disappear. When you run a custom audit report to view the workstation activity, there are events that are missing that never get written to the database.
Issue resolved in hotfix 607668 and new workstation agent. Please Contact Support for a copy of the hotfix and new workstation agent.