Thank you very much for the explanation! It helps a lot to know what you are working with and it is also good to know that what looks as an accident is in fact intentional.
I did not check Viorel's solution in detail, but rather I started on my own, but I took benefit of the CREATE TABLE + INSERT that Ronen had in his script..
CREATE TABLE T (computername VARCHAR(100),currentuser VARCHAR(100), DT datetime, TheOrder INT)
GO
TRUNCATE TABLE T
GO
INSERT T(computername, currentuser, DT, TheOrder)
VALUES
('abc', 'xyz', CONVERT(DATETIME,'7/5/2022 20:04:51',101),1),
('abc', 'xyz', CONVERT(DATETIME,'7/5/2022 20:04:51',101),1),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 6:45:51',101),1),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 6:45:51',101),1),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 7:06:45',101),2),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 7:06:45',101),3),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 7:07:00',101),4),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 7:59:12',101),2),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 7:59:12',101),3),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 7:59:19',101),4),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 7:59:21',101),5),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 21:28:19',101),1),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 21:28:19',101),1),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 21:28:24',101),2),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 21:28:24',101),3),
('abc', 'xyz', CONVERT(DATETIME,'7/6/2022 21:28:24',101),4)
go
SELECT * FROM T
go
; WITH DistinctValues AS (
SELECT DISTINCT computername, currentuser, DT, TheOrder
FROM T
), GetPrevOrder AS (
SELECT computername, currentuser, DT, TheOrder,
LAG(DT) OVER (PARTITION BY computername, currentuser ORDER BY DT) AS PrevDT,
LAG(TheOrder) OVER (PARTITION BY computername, currentuser ORDER BY DT) AS PrevOrder,
LEAD(TheOrder) OVER (PARTITION BY computername, currentuser ORDER BY DT) AS NextOrder
FROM DistinctValues
), InterestingOnes AS (
SELECT computername, currentuser, DT, PrevDT
FROM GetPrevOrder
WHERE TheOrder = 1 OR
TheOrder = 2 AND PrevOrder > 2 OR
NextOrder IS NULL
), pairing AS (
SELECT computername, currentuser, DT AS starttime,
LEAD(PrevDT) OVER (PARTITION BY computername, currentuser ORDER BY DT) AS endtime
FROM InterestingOnes
)
SELECT computername, currentuser, starttime, endtime
FROM pairing
WHERE endtime IS NOT NULL
go
DROP TABLE T