Hi Guys!

I have a one liner script that is supposed to query certain user account locked out alerts in the last 12-hours, every time I run the command, it does not return the locked out alert for that certain user in the last 3 hours, actually the behavior is the same for any user that I query.

For example, if I run the script at 1:00:PM, it will only return data up to 10:00AM in the morning.

I think the issue is global because even for other alert, if I query using the same script, the result is the same.

What I would like to achieve is display all alerts for this user up to the current date/time, within the 12 hours period.

Below is my one liner script:

Get-SCOMAlert -Criteria “ResolutionState = ‘0’ AND CustomField1 like ‘John.Doe’ ” | where {$_.TimeAdded -gt (Get-Date).addhours(-12)} | Select @{Name=”Date”;Expression={$_.TimeAdded}},@{Name=”Username”;Expression={$_.CustomField1}},@{Name=”AccountLockedOutSource”;Expression={$_.CustomField2}}


Blake Nanabil answered