McAfee ePO (a.k.a McAfee Virus Scan) has a add-on component that can be administered through the centralized ePO console for end point configuration scanning as well as there is another component for DLP passive sensitive data scanning of systems.bit can block devices, auth specific devices, and allow transfer of only specific data.. Depending on scale it can be an expensive or very cost effective solution.
We had Symantec SEP and CSP as well but are in the process of removing them as they are HUGE resource on the system itself as well from what I understand the SEP component generated tons of excess network activity. Basically a hog and are a pain all around, some of it may have been the people... I just saw what it did to my production systems anytime they touched the config for it.
It is not 100% clear of the end goal or content your are wanting to protect, if you are looking for sensitive data searches there are a variety of specialized tools for the specific data.
I have personally used Card Recon and McAfee's agent and appliance based DLP for sensitive data search. Card Recon is really good for CHD with VERY low false positive rates on card data and can do other data types, but does miss some things. McAfee DLP requires some serious tuning to reduce false positives so the results are digestible.