How to Run a PII Scan Across Your Team's Windows PCs

Scanning one computer for sensitive data is straightforward. Doing it for a whole office, consistently and without turning it into a month-long project, is where most efforts stall. Here is a practical workflow for a small team, with the settings and trade-offs that actually matter.

1. Decide what to cover

Make a short list of every place data can live: each computer's local drives, the OneDrive or Google Drive folders synced to it, and any external or USB disks. Skipping one leaves a blind spot, and old USB disks and forgotten folders often hold the oldest files. MyVaultMate is one small file per system that you download and run. It supports Windows 10 and 11 (64-bit) and Linux; it is not offered for Apple computers or Windows Server.

2. Add each computer

Nothing is installed and no administrator rights are needed: download one file from your dashboard, run it and sign in with your account. Your IT provider can script it with command-line flags. The Windows file is not code-signed yet, so SmartScreen may show a warning the first time; choose "More info," then "Run anyway," if you trust the file you downloaded from your own account. Start with two or three machines, one of them a shared front-desk PC, then roll out to the rest once you have seen how the results look.

3. Know what it looks for

The agent detects Social Security numbers and ITINs by pattern, and payment card numbers by pattern plus the Luhn check. It detects driver's license numbers, passport numbers and dates of birth only when the value sits next to its label, such as "DL no.," "passport" or "DOB." It finds Medicare numbers by their fixed format, medical record numbers and health insurance member IDs next to their labels, and provider NPI numbers next to their label with the NPI check digit. It also gives a keyword signal when a file reads like a medical record. Email addresses, phone numbers and IP addresses are flagged too, at Low severity, so a contact list shows up near the bottom of the list rather than the top. It also checks for international bank account numbers (IBANs), EU and UK national ID numbers and GDPR special-category data.

File types read are Word (.docx and .doc), Excel (.xlsx and .xls), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg messages. Pictures, videos, recordings and PDFs that are only a scanned picture of each page are not read; each is listed as “Not scanned” with a risk score of 70. RTF and PowerPoint files, Outlook .pst data files, and zip archives are not scanned yet, so plan to check those another way.

4. Choose the schedule and the weight

The first scan of any path is a full scan. After that, incremental scans re-read only changed files. You can run manually or hourly, daily or weekly, and new organizations default to hourly incremental scans. Scans back off while someone is using the computer, so staff rarely notice them. The default scan skips AppData and caches.

5. Read the results in order

Findings are ranked from Critical to Low and can be viewed by computer or by data type. Work from the top. A spreadsheet of SSNs on a laptop outranks one stray date of birth in an old letter. Expect occasional false alarms, since detection is rule-based, and open the top files to confirm before acting. Health findings are a signal about the file, not a list of individual records.

Each finding shows the file path, file type, kind of data, severity, the compliance frameworks involved, and at most a short redacted sample such as ***-**-1234. The files and the full values never leave the machine and are never stored, so the report does not become another copy of what you are protecting.

6. Fix, then re-scan

The product finds and ranks; it moves or deletes nothing on its own. Your team or IT provider handles that. Delete what is not needed, move what is into access-controlled, encrypted storage, and re-scan. Findings can be worked through from the list, and each re-scan updates it. For records, export to PDF, CSV or XLSX, or generate the branded exposure report with files scanned, files with exposed data, high-severity findings, devices affected and an estimate of the ID numbers found.

A first-week checklist

• Add three computers and run the first full scan.
• Review every Critical finding by hand.
• Assign each fix to a person with a date.
• Keep the default hourly schedule, or set a scan window (for example overnight) if you prefer.
• Calendar a monthly review of the dashboard.

You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).