Here ya go, try this...
--Michael Civitillo
--Real Time User Activity
SELECT
cid.[Name] Computer,
(lo1.Domain + '\' + lo1.[User]) [User],
lo1.[Event],
lo1._eventTime [Event Time]
FROM
Evt_AeX_Client_LogOn lo1
join Inv_AeX_AC_Identification cid
on cid._ResourceGuid = lo1._ResourceGuid
WHERE exists
(
select _ResourceGuid, _eventTime
from
(
select lo2._ResourceGuid, max(lo2._eventTime) _eventTime
from Evt_AeX_Client_LogOn lo2
group by lo2._ResourceGuid, lo2.[Event]
) lo3
where lo1._ResourceGuid = lo3._ResourceGuid
and lo1._eventTime = lo3._eventTime
)
ORDER BY
[Event Time] desc