User creates files, exceeds warning level, event is written to event log. User immediately hard-deletes files so disk usage falls under warning level. User immediately creates more files and exceeds warning level again. But when you check the event log, there is only one “user hit their quota threshold” event recorded. Why? Windows waits one hour after writing a quota event for a user before writing the same event a second time. You can modify the quota notification time by editing the registry. See Microsoft Knowledge Base article 228812 for more details.
