I am constantly having to tell my 100+ users NOT to shut down their Macs. I'm wanting them to just logoff so I can do remote updates in the evenings and the weekends. There is a way to make the Mac a kiosk, which in turn disables the Shutdown, Restart, and Logout menus from the Apple menu. Unfortunately, there isn't a way to just disable Shutdown. So ... I decided to approach the situation from a different perspective. I modified the dict section of root's com.apple.loginwindow.plist to look like this:
<dict>
<key>LogoutHook</key>
<string>/sbin/newreboot</string>
<key>PowerOffDisabled</key>
<string>true</string>
</dict>
Essentially, this disables the "Reboot" and "Shutdown" buttons from the login window and runs the script /sbin/newreboot. The newreboot executable is just /sbin/reboot copied and renamed. Then I changed the permissions on /sbin/newreboot to 777. Renaming the executable and changing the permissions is essential. You must change the permissions for it to run as a loginhook and you must change the name or repair permissions will change it back to defaults.
Mac OS X Hints
http://hints.macworld.com/article.php?story=20040306121548561