This sounds like it would be a simple request, but it quickly becomes boiling the ocean.
While there are commercial products that do this (and the reasons will become apparent), basically you need to run your query (all users where date modified is < 10 minutes ago). Unfortunately, this won't tell you what has changed. I don't think it will tell you who has made the change, either (You may be able to put it together with Event Viewer AD Logs.) (I'm not positive, but this may also pick up password changes.)
What you would also need to do to complete that picture, you basically need to export every user and all of their properties, and keep time-stamped records of them.
At this point, I'd like to point out that you're making multiple separate databases that contain (a subset) of the contents of Active Directory.
After you have your list of users-changed, you then have to do a diff on the object's current and previous state, and present that data to whomever cares.
Then, at some point, you're going to have to clean things up, because keeping multiple copies of your AD objects around is going to start taking up space... Once the report of the changes is out, you only really need to keep the current and immediately previous record.
Depending on the number of users in your environment, the number of people who can make changes (admins, helpdesk, etc), and the frequency of those changes, this could very easily get unmanageable fast.
Honestly, Unless you're trying to quickly discover wrongdoing, 10 minutes is probably overkill; I would do no more than an hour, and probably a daily record.
But, here are some places to get you started:
- VBScript Tutorials:
- Powershell Tutorials: