A graphical session needs its own service
RDP and VNC provide graphical access rather than an ordinary SSH shell. The remote machine must run the appropriate service, permit your account and accept the selected route. Installing LeapTerm does not itself enable Remote Desktop or a VNC server on another machine.
Graphical support depends on the platform, enabled tools and release. Native profiles expose RDP (NLA) and VNC (VeNCrypt) when supported.
An administrator-configured self-hosted browser workspace may expose graphical profiles when its selected server supports them. If Check desktop availability appears, complete that check before entering profile or password details. This Gateway handles the graphical protocol and credentials, so it is part of the trusted environment.
Protected browser desktop access, where included in your release, uses the installed Protected workspace client with an enrolled customer agent, an independently verified agent public key and approval of this device's exact local key.
Connect to a desktop
- Confirm the administrator's approved protocol, address, port and authentication method.
- Create or open the matching enabled RDP or VNC profile in the native client or administrator-configured self-hosted workspace.
- Review the security settings and any identity or certificate prompt before connecting.
- Open the remote graphical desktop control for that profile.
- Check the displayed machine before entering sensitive information or changing settings.
Clipboard, keyboard, resizing and other redirected features can differ by protocol and platform. Verify the actual feature you need rather than inferring it from the desktop being visible.
Use an enrolled browser desktop
In Protected workspace, open Device enrollment and use the approved public enrollment for the intended RDP or VNC target. Independently verify the agent key before choosing Enroll new device locally, or choose Use existing local enrollment for a device already enrolled. Have the customer administrator approve the exact device key shown by this client. Account sign-in or a configured Gateway alone does not grant desktop access.
Choose Attach existing session to view the original runtime, or Start new session explicitly when you intend a new connection. Wait for the complete remote display, then choose Continue here to request control. Viewer ready permits viewing; input requires Controller ready and the current control grant.
Disconnect retires this device's attachment and leaves the remote runtime running. If the original runtime has ended or changed, attaching it does not silently create a replacement.
In-app remote browser surface
In a supported native or administrator-configured Gateway workspace, the Browser tool can display internal web services and admin dashboards through remote Chromium on a connected SSH host. The remote environment needs the browser dependencies and permissions for that workflow. Check the displayed target and address before entering credentials.
Per-page Cloud Sync shares the saved address, title and workspace metadata across your authorized devices. Enable it for the intended page and wait for Cloud Sync: saved; pending, paused or conflicting metadata is not confirmed recovery. Page text and screenshots are not included in that metadata sync.
Continue from here requires the original enrolled customer-agent browser and an independently trusted installed app authorized for that exact runtime and page. It reattaches to the surviving page; form state and the live DOM depend on that original browser staying alive. Saved metadata alone does not grant access or recreate an ended page. Use Open new page explicitly when you intend a new page.
When AI Explain is configured, it can inspect the visible page. Review the page information before sharing an explanation through Copy to clipboard or an available Fix in AI Task handoff.
Trust the complete route
A desktop or browser surface can display passwords, documents and private notifications. Only share it with authorized viewers. Do not expose an unprotected graphical service to the public internet to make it reachable; use the administrator's approved network path.
An encrypted outer connection does not make every inner service secure against every participant. A Gateway that handles a remote protocol is part of the trusted environment. Read privacy and trust for the distinction.
For individual remote application windows rather than a full desktop, see X11 applications. For failures, report the protocol, platform and route—not a screenshot containing private desktop content.