NetSecWallFree trialDownload
Port 135 · TCP

Port 135: RPC Endpoint Mapper

The directory for Microsoft Remote Procedure Call: a client asks here which port a Windows service is on, then connects to that port.

Protocol
TCP
On Windows
svchost.exe (RPC Endpoint Mapper, RpcEptMapper)
Risk if open to the internet
High

Seeing it on your PC

Every Windows PC listens on 135. Domain management, remote administration tools and some printer drivers use it on a local network.

Should you block it?

It must never be reachable from the internet; the Blaster worm spread through it in 2003. Outgoing 135 to an internet address is unusual.

Check it on your PC

Run this in PowerShell to see what is using port 135 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 135 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound TCP 135" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.