Clone Windows VM - avoid saving clear text for domain password

When using "Clone, Windows with single NIC" in my schema, it needs a string password to join the domain.  How can I change this to a SecureString or avoid saving the password of a domain user in clear text in the workflow?  Since the goal is to automate the VM deployment, setting the variable to an input parameter is not an option.