WINDOWS SERVICE
RpcEptMapper: RPC Endpoint Mapper
Resolves Remote Procedure Call (RPC) interface identifiers to transport endpoints.
TECHNICAL SUMMARY
| Service name | RpcEptMapper |
|---|---|
| Display name | RPC Endpoint Mapper |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k RPCSS -p |
| Runs as | NetworkService |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft states that if it is stopped or disabled, programs using RPC services stop functioning properly, and its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. On the PC used for this page it was Automatic and running, and Windows did not accept a stop request for it.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service RpcEptMapper | Format-List Name, DisplayName, Status, StartType sc qc RpcEptMapper
Common questions
What does the RpcEptMapper service do?
Resolves Remote Procedure Call (RPC) interface identifiers to transport endpoints. It runs C:\Windows\System32\svchost.exe (svchost.exe -k RPCSS -p) as NetworkService.
Can I disable RpcEptMapper?
Leave it alone. Microsoft states that if it is stopped or disabled, programs using RPC services stop functioning properly, and its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. On the PC used for this page it was Automatic and running, and Windows did not accept a stop request for it.
How is RpcEptMapper related to RpcSs?
They are two services in one process. On Windows 11 build 26300 both are registered under svchost.exe -k RPCSS -p, and the running svchost.exe hosted exactly these two: RpcEptMapper and RpcSs (Remote Procedure Call). RpcEptMapper itself has no dependencies; on that PC the Local Session Manager and the System Events Broker listed it among theirs.
How do I check that it is the real service?
On build 26300 it runs as NetworkService and loads C:\Windows\System32\RpcEpMap.dll, signed by Microsoft Windows. tasklist /svc /fi "services eq RpcEptMapper" shows the svchost.exe process that hosts it together with RpcSs.