This is what we've used a long time. You can unremark the computer or user lines to suit your needs;
SELECT
Inv_AeX_AC_Identification.Name,
Evt_AeX_Client_LogOn.[Domain],
Evt_AeX_Client_LogOn.[User],
Evt_AeX_Client_LogOn.[Event],
Evt_AeX_Client_LogOn.[Time] as [Date and Time]
FROM
vComputer INNER
JOIN Evt_AeX_Client_LogOn ON vComputer.Guid = Evt_AeX_Client_LogOn._ResourceGuid LEFT OUTER
JOIN Inv_AeX_AC_Identification ON vComputer.Guid = Inv_AeX_AC_Identification._ResourceGuid
WHERE
--(Inv_AeX_AC_Identification.Name LIKE '%computername%')
--Evt_AeX_Client_LogOn.[User] = '%userid%'
ORDER BY Evt_AeX_Client_LogOn.[Time] DESC