Screen Protection & Endpoint Watermarks for Windows
Show a tiled screen protection watermark on Windows PCs when a URL, program name, or window title contains your match. Style the overlay—including {user} and {computer}—in the Settings Profile.
Where
Settings Profile → Screen protection
Conditions
Always · URL · Program · Window title
Watermark
Tiled text · {user} · angle · dual colors
Apply
About 5 minutes after you save
What traditional DLP often misses
USB, email, and web controls focus on files and transfers. They do not stop someone from photographing an open CRM, ledger, or deal screen with a phone.
OctoWatch screen protection addresses that risk on Windows. The Grabber draws a visible watermark on the display so a photo or shoulder-surfing glance includes who was signed in and which PC was used. Use it with Data Loss Prevention for channel controls, and with clipboard monitoring when you also need Print Screen blocked.
What is a screen protection watermark?
A screen protection watermark is repeating text the Grabber overlays on the user’s monitors when Enable screen protection is on and any Condition matches. You configure it under Settings Profile → Screen protection, alongside the Main, Additional, and Mail/Social tabs.
It is not screen recording, Live View, a Rules action, server-side blur of Screenshots, or an invisible forensic mark. It is a visible tiled watermark meant to deter misuse and help identify the source if a photo leaks.
Deterrence
Clear on-screen notice
Users see account and machine details on the display, which discourages casual phone photos and shoulder-surfing.
Attribution
Who, which PC, when
Include {user}, {computer}, {date}, and {time} so a leaked photo still carries session context.
Scope
Conditional or always on
Mark only sensitive URLs, programs, or window titles—or keep the watermark on the full desktop when the whole session is sensitive.
Control
Centralized profiles
Manage settings in the Web Console, assign by user or group, and use the same Grabber as the rest of monitoring and DLP.
Always-on desktop watermarks
Choose condition mode Always when every screen for that profile should stay marked.
Add an Always rule in the Conditions list (Add, Edit, Remove). Alone or with other rules, it can keep the watermark visible whenever the profile is active. That fits shared kiosks and roles where nearly everything on screen is sensitive.
Conditional screen protection watermarks
Most teams show the watermark only when a sensitive app, site, or window is active. Matches use simple contains text—not AI classification.
URL
If URL contains
Match a URL fragment such as a CRM host, banking portal, or HRIS path. The watermark appears when the browser address includes that text.
Program
If program name contains
Match part of the application name—desktop clients, ERP tools, or internal programs.
Window title
If window title contains
Match text in the window title bar. Useful when one app hosts many contexts and only some titles are sensitive.
Rules list
Multiple conditions
Add Always, URL, program, and title rows as needed. The watermark shows when any listed condition is met.
Examples: URL contains your Salesforce host; program name contains the banking client; window title contains a matter or patient module label. Keep matches specific so everyday browsing is not marked.
Compose the watermark: text, tile, angle, colors
With Enable screen protection turned on, the Watermark group controls the text and how densely it covers the display.
| Control | What it does |
|---|---|
| Text | Free-form watermark text. Mix static labels with variables. |
| Variables | {user} (account), {computer} (machine name), {date}, {time}—so a photo still shows who, which PC, and when. |
| Horizontal / vertical interval (px) | Spacing between repeats. Smaller gaps make a denser tile across the screen, not a single corner stamp. |
| Text opacity % | Transparency level so the mark stays readable without covering the UI. |
| Angle (deg) | Rotates the tiled text for better coverage on wide monitors and harder cropping. |
| Color 1 / Color 2 (HTML) | Two contrasting colors (gradient fill) so text stays visible on light and dark backgrounds. |
| Font size (px) | Size of the overlay text. |
| Preview | Live canvas preview in the Web Console (click to zoom). Adjust settings before you assign the profile. |
Unlimited monitors are supported. After you save the Settings Profile, changes usually apply within about 5 minutes. Use two contrasting Color 1 / Color 2 values so the tile stays readable on light and dark screens.
Example watermark text
A solid starting string for most desks:
{user} · {computer} · {date} {time}
Add a short policy label if you need it (for example CONFIDENTIAL · {user} · {computer}). In Preview, set dual colors and a moderate angle so a phone photo cannot crop the mark away easily. For high-risk roles, reduce the horizontal and vertical intervals for denser coverage.
Why keep watermarks inside employee monitoring and DLP
A standalone watermark tool only marks screens. OctoWatch runs screen protection in the same Grabber and Web Console as activity tracking, Screens, Live, clipboard, file/USB controls, and Rules—one profile model, Cloud or On-Premise, with floating licenses by active tracked users.
You do not need a second agent for watermarks. Assign Settings Profiles by user or group, keep marks on sensitive contexts, and still investigate with Screens, Day Viewer, or Risks when other alerts fire. If someone shares a marked desktop in a meeting, participants see the same overlay—another reason to use conditional rules when only some apps should be marked. See Employee Monitoring and Monitoring Profiles for the wider platform.
Visual leak control stack
Screen protection is one control. Match the tool to the leak path.
| Need | Use | Page |
|---|---|---|
| Deter or attribute phone photos and shoulder-surfing | Screen protection watermarks (Settings Profile) | This page |
| Block Print Screen or clipboard paste | Clipboard Settings: Block Print Screen, Block clipboard | Clipboard Monitoring |
| Evidence of what was on screen | Screenshots and video in the Web Console | Screenshots & Video |
| Intervene in real time | Live view / remote control | Live View |
| Alert on policy hits | Rules Profile → Risks / email | DLP Rules & Alerts |
| Disclose monitoring | Show monitoring warning / Timetable hours | Stealth & Transparent Monitoring |
Watermarks do not replace channel DLP. They mark the display. They do not block USB, web uploads, or Print Screen on their own.
How to enable screen protection watermarks
Four steps from Settings Profile to a marked PC.
Enable and add Conditions
Open Settings Profile → Screen protection. Turn on Enable screen protection. Add Always and/or URL, program, or window title contains rules.
Compose and Preview
Set Text (with {user}, {computer}, {date}, {time}), intervals, opacity, angle, Color 1/2, and font size. Use Preview (zoom) until contrast looks right.
Assign the profile
Apply the Settings Profile to users or groups, then save. Allow about 5 minutes for Grabbers to pick up the change.
Verify on the endpoint
Open a matching app, URL, or title and confirm the tiled watermark. Add Block Print Screen or Screenshots where policy requires them.
Common use cases
Where conditional watermarks help day to day.
Finance and ops screens
Mark ledgers, trading, or ERP windows by program name or window title so photos of balances still show who was signed in.
Contractors on portals
Use URL-contains rules for vendor portals and CRM hosts without marking every personal browser tab.
Shared desks and open floors
Use Always, or a denser tile with dual colors, on workstations where screens face walkways.
Remote and hybrid staff
Put {user}, {computer}, and time on dashboards so phone photos of remote sessions are harder to circulate anonymously.
Compliance and confidential review
Mark finance, legal, or HR systems during audits and deal work so screen photos remain identifiable. See Compliance Monitoring and our pages for financial services, healthcare, and law firms.
Example policy mix
Finance: Always, with text {user} · {computer} · {date} {time}. Contractors: URL contains your CRM or vendor host only. For high-risk groups, also enable Block Print Screen under Clipboard.
Cloud, On-Premise, and Windows RDS
The same Screen protection Settings Profile works in Cloud and On-Premise; only where data is stored changes. Deploy the Grabber the usual ways (manual install, AD GPO, Installation Utility, or silent install). On Windows Terminal Server and RDS, the Grabber can apply profiles per session—see Terminal Server & RDS Monitoring. OctoWatch does not include a separate Citrix module.
Screen protection is part of Employee Monitoring & DLP, not the Time Tracking-only plan. Compare options on Pricing. Limit who can edit Settings Profiles in Profiles & Access. For notice and work hours, use Show monitoring warning and a Timetable—see Stealth & Transparent Monitoring.
Screen protection best practices
- Start with conditional rules—Use URL, program, or window title contains matches for sensitive systems. Reserve Always for desks where the whole session stays sensitive.
- Put identity in the text—Include at least
{user}and{computer}. Add{date}and{time}when photos need a timestamp. - Use dual contrasting colors and Preview—Adjust opacity, angle, and intervals until the tile is readable without covering the work.
- Combine with capture controls—Watermarks deter photos. Add Block Print Screen for OS captures, and Screenshots or video when you need evidence.
- Disclose and limit access—Turn on Show monitoring warning when policy requires notice, and limit who can edit Settings Profiles.
- Wait about 5 minutes after save—Confirm the watermark on a matching app or URL before you roll the profile out widely.
Frequently asked questions
What is a screen protection watermark?
A visible, repeating text overlay the Grabber draws on Windows monitors when Screen protection is enabled and a Condition matches. Variables in the text help identify the session if a photo leaks.
How do screen watermarks help prevent data leaks?
They do not block a phone camera. They discourage unauthorized photos and shoulder-surfing by putting who, which PC, and when on the screen, and by reminding users the session is protected.
Can watermarks show only on specific apps or websites?
Yes. Add Conditions for If URL contains, If program name contains, or If window title contains. You can combine rules; the watermark shows when any rule matches. Use Always for full-desktop coverage.
Can I control spacing, angle, and colors?
Yes. Set horizontal and vertical interval (px), angle (deg), Color 1 and Color 2 (HTML), font size (px), and text opacity %. Preview in the Web Console before you assign the profile.
Does OctoWatch use invisible or forensic watermarks?
No. Screen protection is a visible tiled watermark. We do not claim invisible forensic recovery from photos. For on-screen evidence, use Screenshots & Video.
Does screen protection block Print Screen?
No. Use Block Print Screen under Clipboard Settings—see Clipboard Monitoring. Watermarks cover visual exposure beyond OS capture keys.
Does it blur Screenshots in the Web Console?
No. Watermarks are drawn on the endpoint display. OctoWatch does not blur captures on the server. Screenshots and video remain separate Settings Profile options.
Does it support multiple monitors?
Yes. An unlimited number of monitors is supported for the watermark overlay.
How fast do Settings Profile changes apply?
After you save the profile, screen protection settings usually apply within about 5 minutes.
Is this the same as Live View or screen recording?
No. Live is real-time remote view and control. Screenshots and video store captures for later review. Screen protection only overlays a watermark on the live display. See Live View and Screenshots & Video.
Cloud and On-Premise?
Yes. The same Screen protection tab and watermark controls apply. Cloud stores encrypted data in the distributed cloud; On-Premise keeps data on your server.
Is watermarking a Rules Profile action?
No. It lives in the Settings Profile under Screen protection. Rules handle notify and block-style actions and Risks—see DLP Rules & Alerts.
Do watermarks show during screen sharing?
Yes. Visible overlays stay on the desktop. If someone shares a marked screen in a meeting, participants see the same tiled text. Use conditional rules when you only want marks on sensitive apps or sites.
What watermark text should I start with?
Use {user} · {computer} · {date} {time}, two contrasting colors, and Preview. Tighten intervals for denser coverage on high-risk desks, and keep matches specific so everyday browsing is not marked.
Questions about Screen protection, Conditions, or watermark styling? Email support@octowatchdlp.com or contact us. Product details: User Guide — Screen protection.