A graphical session needs its own service
RDP and VNC provide graphical access rather than an ordinary SSH shell. The remote machine must run the appropriate service, permit your account and accept the selected route. Installing LeapTerm does not itself enable Remote Desktop or a VNC server on another machine.
Graphical support depends on the platform, enabled tools and release. Native profiles expose RDP (NLA) and VNC (VeNCrypt) when supported.
An administrator-configured self-hosted browser workspace may expose graphical profiles when its selected server supports them. If Check desktop availability appears, complete that check before entering profile or password details. This Gateway handles the graphical protocol and credentials, so it is part of the trusted environment.
Protected browser desktop access, where included in your release, uses the installed Protected workspace client with an enrolled customer agent, an independently verified agent public key and approval of this device's exact local key.
Connect to a desktop
- Confirm the administrator's approved protocol, address, port and authentication method.
- Create or open the matching enabled RDP or VNC profile in the native client or administrator-configured self-hosted workspace.
- Review the security settings and any identity or certificate prompt before connecting.
- Open the remote graphical desktop control for that profile.
- Check the displayed machine before entering sensitive information or changing settings.
Clipboard, keyboard, resizing and other redirected features can differ by protocol and platform. Verify the actual feature you need rather than inferring it from the desktop being visible.
Desktop controls and live telemetry
During an active VNC (VeNCrypt) or RDP (NLA) session, the floating control bar and the right-edge Remote Desktop Controls drawer let you adjust display scaling (Aspect Fit, Stretch, Original Size, Resize to Fit), toggle High DPI, send Ctrl+Alt+Del or Windows Key, sync clipboard text (Paste to Remote and Copy from Remote), and open the Virtual Trackpad on touch or compact viewports.
When connecting through a configured Cloudflare Relay or enrolled Connector, the drawer badge and Stats for nerds overlay report the active RELAY route alongside the LEAP_RAW_V1 zero-Base64 binary frame codec efficiency.
VNC with multiple concurrent applications
VNC shares the remote X11 root framebuffer (1024×768 on DISPLAY=:91) across all graphical applications running in that display session (for example Chromium, a native X11 workspace editor, xclock, xcalc, and xeyes). Pointer hit-testing and PointerRoot / window-manager focus route clicks and keyboard input (LPRI 16-byte binary input packets) to whichever application window is under the cursor or holds focus, while the LEAP_RAW_V1 (LPRF) binary frame codec coalesces dirty 64×64 tiles across concurrently updating windows in a single binary delta frame.
Enable Stats for nerds in the floating toolbar or drawer to inspect live framebuffer resolution, route status (DIRECT or RELAY), LEAP_RAW_V1 / ODF1 frame compression efficiency, frame rate, round-trip latency and live bandwidth sparklines.
Use an enrolled browser desktop
In Protected workspace, open Device enrollment and use the approved public enrollment for the intended RDP or VNC target. Independently verify the agent key before choosing Enroll new device locally, or choose Use existing local enrollment for a device already enrolled. Have the customer administrator approve the exact device key shown by this client. Account sign-in or a configured Gateway alone does not grant desktop access.
Choose Attach existing session to view the original runtime, or Start new session explicitly when you intend a new connection. Wait for the complete remote display, then choose Continue here to request control. Viewer ready permits viewing; input requires Controller ready and the current control grant.
Disconnect retires this device's attachment and leaves the remote runtime running. If the original runtime has ended or changed, attaching it does not silently create a replacement.
In-app remote browser surface
In a supported native or administrator-configured Gateway workspace, the Browser tool can display internal web services and admin dashboards through an SSH Auto Tunnel or through remote Chromium on a connected SSH host. The remote environment needs the browser dependencies and permissions for that workflow. Check the displayed target and address before entering credentials.
When Auto Tunnel is switched Off (or when routing through a Cloudflare Relay / Remote Browser Helper), the Browser surface streams remote viewport frames (LPBF raw binary frame stream) and displays the AI Operating Browser supervision banner and interactive Type into page controls when an agent or operator interacts with the page.
Per-page Cloud Sync shares the saved address, title and workspace metadata across your authorized devices. Enable it for the intended page and wait for Cloud Sync: saved; pending, paused or conflicting metadata is not confirmed recovery. Page text and screenshots are not included in that metadata sync.
Continue from here requires the original enrolled customer-agent browser and an independently trusted installed app authorized for that exact runtime and page. It reattaches to the surviving page; form state and the live DOM depend on that original browser staying alive. Saved metadata alone does not grant access or recreate an ended page. Use Open new page explicitly when you intend a new page.
When AI Explain is configured, it can inspect the visible page. Review the page information before sharing an explanation through Copy to clipboard or an available Fix in AI Task handoff.
Trust the complete route
A desktop or browser surface can display passwords, documents and private notifications. Only share it with authorized viewers. Do not expose an unprotected graphical service to the public internet to make it reachable; use the administrator's approved network path.
An encrypted outer connection does not make every inner service secure against every participant. A Gateway that handles a remote protocol is part of the trusted environment. Read privacy and trust for the distinction.
For individual remote application windows rather than a full desktop, see X11 applications. For failures, report the protocol, platform and route—not a screenshot containing private desktop content.