The LEM correlates, normalizes and displays information from syslog and SNMP sources. If everything your users do is on devices that syslog those activities AND those devices are set to a logging level to capture that AND the devices get their syslog data to the LEM, then the LEM would record all that activity in some manner. The LEM is limited by what information is syslog'd by nodes and what information those nodes send to the LEM.
Edit: The LEM also can gather information from Agents installed on machines. Agents are available for a number of operating systems, including Windows, MacOS and Linux.
I would say yes as long as you have agents on your E-Mail and File-server installed and Windows Auditing is activated for the users / resources.
Let me know if you need further help.