So as some of you might have noticed, Windows likes to hit you with double events. Take Kerberos for example. When Kerberos goes to authenticate a user, it first fails the users authentication, then does a "Success" or "Failure". Or, when turning off a windows machine or restarting the machine, it will (sometimes) send 2 "windows shutdown" events. this is causing major problems with my rules. If you have any information that could help me fix my rules to accommodate this, I would be SUPER grateful.