locator.exe
Also called locator, rpc locator, rpclocator
Historic RPC Locator image (RpcLocator). On modern Windows the everyday endpoint mapper is the RpcEptMapper service inside svchost.exe, not this leftover exe.
What you need to know
Historic RPC locator image, not the everyday RpcEptMapper svchost group.
locator.exe is the old RPC Locator binary. Current Windows maps RPC endpoints with RpcEptMapper, which runs in svchost.exe. Seeing locator.exe idle in System32 is leftover image, not proof the mapper is "an exe you start." Starting RpcLocator is unused on modern SKUs.
- Safe?
- Yes, in System32 if present
- Is it RpcEptMapper?
- No. That mapper is a svchost service
- Should it be running?
- Usually no on current Windows
What is locator.exe?
locator.exe is the historic RPC locator image, not the everyday RpcEptMapper svchost group. RpcEptMapper is the service that maps endpoints on current Windows.
What does it do?
The old RpcLocator service used this file. Modern RPC clients talk to the endpoint mapper in svchost. This exe sitting on disk does not mean that mapper moved back into a standalone process.
Why is it running?
You opened the file location, an old script started RpcLocator, or a compatibility tool touched it. A healthy PC usually keeps RpcEptMapper running and locator.exe not in the active list.
Is it safe?
Usually safe as a leftover image
System32 locator.exe is the historic Microsoft image. A locator.exe in Downloads is not RpcLocator. The live mapper is still RpcEptMapper in svchost, not this filename.
A legitimate copy normally runs from:
C:\Windows\System32\locator.exe
- Historic RpcLocator image
- Live mapper: RpcEptMapper in svchost.exe
- Do not start RpcLocator to "fix RPC"
Can I end it?
Usually nothing useful
Ending locator.exe only matters if something actually started the old service. It does not restart RpcEptMapper. Killing the wrong svchost group is how you break RPC.
Can I remove it?
No
Do not delete locator.exe from System32. Leave the leftover image. Disable RpcLocator if a policy still starts it. RpcEptMapper stays.
Should it start with Windows?
RpcLocator should not auto-start on current Windows. RpcEptMapper is the service that should already be running.
Normal resource behavior
These are contextual labels, not universal averages.
- CPU
- Should be none if the old service is not started
- Memory
- Small if someone started it
- Disk
- None in normal use
- Network
- Historic locator traffic only if that service is on
File information
| Executable name | locator.exe |
|---|---|
| Common legitimate path | C:\Windows\System32\locator.exe |
| Publisher | Microsoft Corporation |
| Signature expectation | Signed by Microsoft Windows |
Common problems
Filename pages say locator is the endpoint mapper
On current Windows the mapper is RpcEptMapper inside svchost.exe. This file is the old image.
Someone enabled RpcLocator "for gaming"
That does not replace RpcEptMapper. Turn the leftover service back off.
Troubleshooting
Diagnose before you change anything destructive.
services.msc: RpcEptMapper, not RpcLocator
The running mapper is a svchost group. locator.exe in Task Manager is the historic image if anything started it.
Do not replace locator.exe from a forum zip
RPC repairs on current Windows are about RpcEptMapper, firewall, and the calling app. Not a downloaded locator.
Technical details
Technical details
| Image name | locator.exe |
|---|---|
| Role | Historic RPC Locator image |
Sources and verification
Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.
- Microsoft Learn: RPC · RPC still uses an endpoint mapper
- Microsoft Learn: service hardening notes · RpcLocator is a leftover; RpcEptMapper is the live mapper
- Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.
Was this article useful?
A yes or no is enough. Pick a reason if you want, or add a short note.
Thanks. That helps us improve this page.