I need to alert for 20 consecutive failed logon attempts within a 30 minute time period

More info: Verifying the changes in the environment... this seems to have only affected the local groups on the utility server itself.  The domain group affiliations don't seem to have been touched.  I would therefore also gather that it isn't making those local changes on the 20-30 devices in my test environment... (Confirmed)... so this script doesn't make the necessary changes in the domain.  Let me verify I'm reading the right part of the deployment KB... also verified.  The script as presented doesn't do the tasks correctly for a domain user.