I realise I am late to party, but....

How can I ensure that they haven't done so by writing their password in emails, scripts, documents or files

#You Can't. Not practically.

Passwords are a single layer authorisation mechanism. If you care about passwords being "written" or recorded then you need to:

• Quantify the risk factor and mitigate these risk types. What is the risk if someone else reads the password? If it's a fellow employee, a member of the public? Add security layers to mitigate these risks (such as asking for additional information at login)

• If doing things such as tracking your userbase keylogs, tracking your userbase physical movements, tracking anything about your userbase in real-time in order to ensure they are not plaintexting their passwords, then you really, really need to up your game, and instead of spending thousands trying to soup up your old ford cortina, invest in a Nissan Skyline and give your userbase hardware-token-authentication and 2FA credentials.

• Encourage better user behaviour. Remembered passwords are easy to remember and by this nature are going to be weak - So you have a choice between a complex password that more people will write down, for reference, or a simple password which is exponentially easier for a machine to brute force or otherwise compromise. So heavily pressure and encourage your userbase to use a Password Manager. So that they can use complex passwords without needing to remember them OR write them down.

I repeat; if you care this much about your users not writing down their passwords you must provide them with valid and reliable alternatives, as detailed on various answers here.

I realise I am late to party, but....

How can I ensure that they haven't done so by writing their password in emails, scripts, documents or files

You Can't. Not practically.

Passwords are a single layer authorisation mechanism. If you care about passwords being "written" or recorded then you need to:

• Quantify the risk factor and mitigate these risk types. What is the risk if someone else reads the password? If it's a fellow employee, a member of the public? Add security layers to mitigate these risks (such as asking for additional information at login)

• If doing things such as tracking your userbase keylogs, tracking your userbase physical movements, tracking anything about your userbase in real-time in order to ensure they are not plaintexting their passwords, then you really, really need to up your game, and instead of spending thousands trying to soup up your old ford cortina, invest in a Nissan Skyline and give your userbase hardware-token-authentication and 2FA credentials.

• Encourage better user behaviour. Remembered passwords are easy to remember and by this nature are going to be weak - So you have a choice between a complex password that more people will write down, for reference, or a simple password which is exponentially easier for a machine to brute force or otherwise compromise. So heavily pressure and encourage your userbase to use a Password Manager. So that they can use complex passwords without needing to remember them OR write them down.

I repeat; if you care this much about your users not writing down their passwords you must provide them with valid and reliable alternatives, as detailed on various answers here.