$Last_n_Hours = [DateTime]::Now.AddHours(-24)
$badRDPlogons = Get-EventLog -LogName 'Security' -after $Last_n_Hours -InstanceId 4625 | ?{$_.Message -match 'logon type:\s+(3)\s'} | Select-Object @{n='IpAddress';e={$_.ReplacementStrings[-2]} }
$getip = $badRDPlogons | group-object -property IpAddress | where {$_.Count -gt 10} | Select -property Name

$uniqueIps = @{}

$current_ips = (Get-NetFirewallRule -DisplayName "BlockRDPBruteForce" | Get-NetFirewallAddressFilter ).RemoteAddress

foreach ($ip in $current_ips)
{
    $uniqueIps[$ip] = $true
}

foreach ($ip in $getip)
{
    $uniqueIps[$ip.Name] = $true
}

$finalBlockedIps = $uniqueIps.Keys | Sort-Object

Set-NetFirewallRule -DisplayName "BlockRDPBruteForce" -RemoteAddress $finalBlockedIps

Write-Output "Blocked addresses:"
$finalBlockedIps 

Write-Output "Blocked address count:"
$finalBlockedIps.Count

$log = "C:\ware\secu\rdp_blocked_ip.txt"
$finalBlockedIps | Select-Object {(Get-Date).ToString() + ' ' + $_} | Out-File $log