Just walk around with a Wi-Fi analyzer on your phone, playing hotter/colder until you find it.

Modern enterprise access points even have built-in functionality to physically locate devices, and automatic warnings for rogue access points. The latter is often ignored or disabled though, because it'll go off every time someone prints or screen casts over Wi-Fi Direct.