Everything was going just fine with LEM until today, I have a rule setup so that if a member of a number of different AD groups signs in with a bad password 3 times I receive a notification. the notifications seemed to be coming after only 2 attempts when I wanted it to come at 3. I checked the rule and realized that windows event logs was writing the same entry twice each time a bad password was entered. I went in and updated the rule to fire at 6 attempts for the same account and saved the changes. However when I doubled checked it after activating, it defaulted to trigger on just 1 attempt. Thinking I had accidentally selected this I went back and modified it again to the correct values, only to find that it was set to trigger on 1 attempt again. I have been able to alter other rules and even this particular rule in the past and have it save the changes, what am I doing wrong this time? For reference I am NOT hitting the apply button, just hitting save; even when I do hit apply first the same thing occurs.
