I run a small office. Twelve Windows machines, one server that everybody treats like a coat rack, and a boss who calls me the IT department because I am the only one who knows where the router lives. Last month a spreadsheet walked out the door on a USB stick. Nothing dramatic, no hacker in a hoodie, just a tired man in a hurry who did not think. I spent the next morning explaining it to people who do not know what a USB port looks like.
So I went looking for something that would stop the second version of that morning from happening. Found It and spent an evening reading what it actually does instead of what the sales page wanted me to feel. It watches the Windows machines. Apps, sites, keystrokes if you turn that on, screenshots, files, USB devices, prints. It sends all that to one web console, and you can run that console in the cloud or keep the server and the SQL database on your own network, which mattered to the boss because the boss likes his data where he can see it.
The part I use most is the rules. You can block a USB, block a site, block a file leaving, or just have it open a risk for you to look at later. You decide which machines get which profile, so the warehouse laptop does not get the same treatment as the bookkeeper's desktop. It also covers terminal server and RDS sessions, which was the thing that decided it for me, because half our work happens in a session on that server and most of the tools I looked at waved that away.
It is stealth by default but you can turn on a warning so people know they are being watched. I turned the warning on. I would rather have them grumble than have another seven in the morning.
Not a cure for a careless man. Nothing is. But the spreadsheet does not leave the building now, and I get to drink my coffee before it goes cold.