Which proxy server to choose under debian for terminal server clients with "silent" authorization?

Question

Debian

Good day!
I ask you not to kick hard if something like this happened: I searched as best I could - I did not find it.
If I searched badly, I will be grateful for the links.
Essence: there is a grid with a zoo of windows machines (xp home (most), 7, 8, 10), a terminal server (2008 r2) and a debian gateway.
Due to zoo fatigue, the decision was made to transfer most of the customers to thinstation. As a result, a number of problems arose. Incl. and the next one: it is not possible to force users to log in to the debain proxy with a login and password. Therefore, the question is: how can you organize authorization on a proxy with a terminal server account login and password (for example, but any data stored on the terminal server is suitable)? Which proxy should I choose for this case and with what authentication? What difficulties may arise in one or another variant (eg: what other services will have to be raised and how gluttonous they are)?
Those. on the thin client, open the browser (with the settings entered) and log in to the proxy with the username and password term. sessions. Silently (without any windows).
The debian gateway now has squid and 3proxy. There is no AD / LDAP (and, unfortunately, I have not had any dealings with them so far).
I will be grateful for help.
...
I'll add. If you choose squid and ntlm (Ad/LDAP), then:
An old server on two xeons 5405 (2 GHz) with 10 GB of RAM. 2008R2.
There is only one license for a win server, and terminals with 1c + thunderbird clients for 20 users (+ little things) are already spinning on it.
1) Will the addition of AD become critical (how gluttonous it is) and is it generally accepted to combine a domain and terminals (or is it better to separate them into different hardware)?
1.5) If it is not desirable to combine, then which LDAP on Debian is better to choose so as not to go through the rake?
2) Some of the cars will remain on hamsters. Wouldn't this be a problem?