########################################################
#Get the number of lock account in less than 10 minutes
########################################################
###########################
# Param
###########################
$LockedSince = 10 #Minutes
$NumberofLockedAccount = 50 #

###########################
# FUNCTIONS
###########################
###########################
# SCRIPT
###########################
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.PageSize = 1000
$objSearcher.Filter = "(&(objectClass=User)(lockoutTime>=1))"
$colProplist = "name","samaccountname","lockoutTime"

foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i) | out-null}
$colResults = $objSearcher.FindAll()

$cpt = 0
$result = $null
$result2 = $null

foreach ($objResult in $colResults) {

    $domainname = $objDomain.name
    $samaccountname = $objResult.Properties.samaccountname

    $user = [ADSI]"WinNT://$domainname/$samaccountname"
    $ADS_UF_LOCKOUT = 0x00000010
    #$objResult.Properties

    if(($user.UserFlags.Value -band $ADS_UF_LOCKOUT) -eq $ADS_UF_LOCKOUT) {
        $Sam = $objResult.Properties.samaccountname
        $Name = $objResult.Properties.name
        [String]$LockTime = $objResult.Properties.lockouttime
        [datetime] $LockTime = [datetime]::FromFileTime($LockTime)

        #We want all the account locked in the last 24h
        $DayDate = Get-Date
        $DayDateBefore = $DayDate.AddMinutes(-$LockedSince)

        if(($LockTime -gt $DayDateBefore) -and ($LockTime -lt  $DayDate))
            {
            Write-Host "************"
            Write-Host "User : $sam"
            Write-Host "Name : $name"
            Write-Host "LockTime : $lockTime"
            Write-Host "************"
            Write-Host ""

            $result2 += "************`r"
            $result2 += "User : $sam`r"
            $result2 += "Name : $name`r"
            $result2 += "LockTime : $lockTime`r"
            $result2 += "************`r"
            $result2 += "`r"

            $cpt += 1
            }
    }
}

Write-Host "************"
Write-Host "There is $cpt account(s) locked in the last $LockedSince minutes"
Write-Host "************"

$result += "************`r"
$result += "There is $cpt account(s) locked in the last $LockedSince minutes`r"
$result += "************`r"
$result += $result2

if($cpt -ge $NumberofLockedAccount)
    {
    Write-Host ""
    Write-Host "Limit reached, /!\ ALERT /!\"
    Write-Host ""
    $infoevent=[System.Diagnostics.EventLogEntryType]::Error
    }
else{
    $infoevent=[System.Diagnostics.EventLogEntryType]::Information
    }  

############################
#Var for the event creation
############################
$evt = new-object System.Diagnostics.EventLog("Application")
$evt.Source = "AD-SCOM"
$evt.MachineName = "."
$evt.WriteEntry($result,$infoevent,6970)