KB Article: http://support.microsoft.com/kb/2653669

INTRODUCTION

Consider the following scenario:

• You configure Microsoft Forefront Threat Management Gateway 2010 to use the User override for blocked categories feature that was introduced in Microsoft Forefront Threat Management Gateway 2010 Service Pack 1 (SP1).
• You configure Forefront Threat Management Gateway 2010 to generate reports so that you can monitor which users are overriding the deny rules.

In this scenario, you may find that the summary information for the Top Overridden URLs table and for the Top Rule Override Users table display incorrect information and the values seem much larger than expected.