Occasional Visitor

We are trying to view when a user logged onto a computer by typing in their user name and password.  I understand that this is an interactive logon.  ATA reports the user performing interactive logons at various times of the night and on to the mail server which is unlikely.


Do I have the right definition of interactive logons or is ATA looking at something different?