How to determine the most active time of a user from active directory logs
As always, start by looking at the data.  Pick a user, and look at their typical login times.  Maybe plot a histogram to show the distribution of time of day of their login.  Pick another user, and look at them.  Pick a few more.  Do you see any patterns?  Do they have a common shape?  Do users fall into a few clusters?  Try to understand the data well.

Then, once you have a feeling for what normal behavior tends to look like, and how it varies from user to user, you can start to think about how to build a model that captures this random behavior and helps you distinguish normal vs abnormal behavior (perhaps by some kind of anomaly detection).

But as always: start by visualizing the data.  Asking how to approach the problem or what machine learning method to use is premature, until you have a better understanding of the data.