We put an intermediary to them behind sso. Only the intermediary can get to the machine and forward guacamole traffic. Solves the no password / everyone in the company having access to test machines. We have a little script that registers endpoint machines with the intermediary and who can access the machine / when. We even log and do time block. The intermediary does password rotation with vault.