I have a Windows 2000 Server with all current patches running Terminal Server
for our users. I am getting hundreds of Event ID 4098. One such example:

Event Type: Warning
Event Source: EventSystem
Event Category: Firing Agent
Event ID: 4098
Date: 11/7/2006
Time: 9:00:13 AM
User: N/A
Computer: REMOVED
Description:
The COM+ Event System failed to fire the Logoff method on subscription
{CE6FFFC9-389B-4350-A4D6-15EA32334D8B}. The subscriber returned HRESULT
800706BA.

Note the section with {CE6FFFC9-389B-4350-A4D6-15EA32334D8B} changes with
every entry in the event log. This is not in the Registery.

I found some information that 800706BA means the RPC server is not
avaliable. The RPC service is running on this server and all other servers
and DNS works fine.

Any idea how I can stop these entries or at least find out which application
is causing the errors?

Thanks - Steve