Today-challenge n.3 : offending patches and SCCM 2012

Hi mates,
I had a big issue during the previous days with a specific Microsoft Patch. The 12 of September MS released an update for Office (KB4011089).
One of my clients had in production SCCM 2012 R2 to install automatically this kind of patches.
The day after a lot of users started calling the helpdesk telling that the cannot open attachments on archived emails . They use a product that is not famous on the market, as we say a "niche" product.
Anyway after investigating a lot we identified the "offending" patch (yes I know that usually patches must be  distributed in a test environment before anything). I wrote  "a lot" because this is a very dinamyc environment : they apply GPO, update and so on everyday, so you have to understand which single change may have had a specific impact.
So at this point two tasks were assigned to me :

Powershell --> Powerquick : retrieve event viewer settings and/or search for locked user account

Hi mates,
quick and useful : check event viewer settings as record count, state (full or....) file size and so on.
Additionally below you can find a separate script that allows you to query Event Viewer searching for locked out users.
Nothing more, it's easy to understand and adapt to your needs.
Here you are :



Hope this help.
Bye