Trying to go passwordless for external vendors, any creative ways to SSO for RDP thats doesnt require an agent on the endpoint (server)