# locator.exe

Windows Process: Microsoft Corporation

Also called locator, rpc locator, rpclocator

Windows, System Component

Historic RPC Locator image (RpcLocator). On modern Windows the everyday endpoint mapper is the RpcEptMapper service inside svchost.exe, not this leftover exe.

## What you need to know

Historic RPC locator image, not the everyday RpcEptMapper svchost group.

locator.exe is the old RPC Locator binary. Current Windows maps RPC endpoints with RpcEptMapper, which runs in svchost.exe. Seeing locator.exe idle in System32 is leftover image, not proof the mapper is "an exe you start." Starting RpcLocator is unused on modern SKUs.

- **Safe?**: Yes, in System32 if present

  **Is it RpcEptMapper?**: No. That mapper is a svchost service

  **Should it be running?**: Usually no on current Windows

Feex says

If I see locator.exe in System32, I treat it as the historic RPC locator image. I look for RpcEptMapper under svchost when RPC is actually broken.

## What is locator.exe?

locator.exe is the historic RPC locator image, not the everyday RpcEptMapper svchost group. RpcEptMapper is the service that maps endpoints on current Windows.

## What does it do?

The old RpcLocator service used this file. Modern RPC clients talk to the endpoint mapper in svchost. This exe sitting on disk does not mean that mapper moved back into a standalone process.

## Why is it running?

You opened the file location, an old script started RpcLocator, or a compatibility tool touched it. A healthy PC usually keeps RpcEptMapper running and locator.exe not in the active list.

## Is it safe?

Usually safe as a leftover image

System32 locator.exe is the historic Microsoft image. A locator.exe in Downloads is not RpcLocator. The live mapper is still RpcEptMapper in svchost, not this filename.

A legitimate copy normally runs from:

`C:\Windows\System32\locator.exe`

- Historic RpcLocator image
- Live mapper: RpcEptMapper in svchost.exe
- Do not start RpcLocator to "fix RPC"

## Can I end it?

Usually nothing useful

Ending locator.exe only matters if something actually started the old service. It does not restart RpcEptMapper. Killing the wrong svchost group is how you break RPC.

## Can I remove it?

No

Do not delete locator.exe from System32. Leave the leftover image. Disable RpcLocator if a policy still starts it. RpcEptMapper stays.

## Should it start with Windows?

RpcLocator should not auto-start on current Windows. RpcEptMapper is the service that should already be running.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Should be none if the old service is not started

  **Memory**: Small if someone started it

  **Disk**: None in normal use

  **Network**: Historic locator traffic only if that service is on

## File information

| Executable name        | locator.exe                     |
| ---------------------- | ------------------------------- |
| Common legitimate path | C:\Windows\System32\locator.exe |
| Publisher              | Microsoft Corporation           |
| Signature expectation  | Signed by Microsoft Windows     |

## Common problems

### Filename pages say locator is the endpoint mapper

On current Windows the mapper is RpcEptMapper inside svchost.exe. This file is the old image.

### Someone enabled RpcLocator "for gaming"

That does not replace RpcEptMapper. Turn the leftover service back off.

## Troubleshooting

Diagnose before you change anything destructive.

### services.msc: RpcEptMapper, not RpcLocator

The running mapper is a svchost group. locator.exe in Task Manager is the historic image if anything started it.

### Do not replace locator.exe from a forum zip

RPC repairs on current Windows are about RpcEptMapper, firewall, and the calling app. Not a downloaded locator.

## Technical details

Technical details

| Image name | locator.exe                |
| ---------- | -------------------------- |
| Role       | Historic RPC Locator image |

## Related

These entities connect to this article. Type is shown on every link.

[rundll32.exe: Windows Process](https://feex.it/wiki/process/rundll32.exe)[Process vs service: Guide](https://feex.it/wiki/software/system/process-vs-service)[What is a Windows process: Guide](https://feex.it/wiki/software/system/what-is-a-windows-process)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: RPC ](https://learn.microsoft.com/windows/win32/rpc/rpc-start-page)· RPC still uses an endpoint mapper
- [Microsoft Learn: service hardening notes ](https://learn.microsoft.com/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server)· RpcLocator is a leftover; RpcEptMapper is the live mapper
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: locator.exe

  **Typical path**: C:\Windows\System32\locator.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/locator.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)