Currently in all variants of OS's there is a hard coded user name and password. This is in the kick start file and preseed files in centos and ubuntu. It is also in the autounatend.xml in windows.
These should be replaced so they are obtained from variables and or use SSH keys. This will allow then to be dynamically generated and obtained from other systems such as Hashicorp Vault.