With PAM, your organization can control access to remote desktop sessions to any inventoried computers. If you need to access a particular machine to perform a task, you request a "check-out" of the vaulted credentials for a specific account on that machine. If approved, you initiate your remote desktop session using Privileged Session Manager (PSM). PSM is an application that is embedded in your browser. When you initiate a remote desktop session, PSM opens the session in your browser using the credentials associated with an account on that machine.
When requesting access to a computer account, you will never see the credentials for that account. This protects both yourself and your organization in that the password can never be compromised.