Using the group policy editor you can turn that ability off in xp.
www.online-tech-tips.com/windows-xp/xp-prevent-shutdown/
Anyways once you've done that your going to want to go on the offensive. Crack open your network analyzer and determine who's sending the packets by monitoring the
local network. It's a little different with each network monitoring tool but basically your just looking for the packet thats created when you attempt to use the shutdown command or the shutdown program(common script program:
www.soft32.com/download_505.html
)
Once you have done this set a flag that emails you each time that packet has been received and have it text you 1 time on the hour (you don't want 50,000 in case the kids get smart). Then you can walk in and catch whoever is doing it red handed while knowing their exact ip and location. (I'm assuming you have mac addresses mapped or you don't use dhcp for this reason.)
Alternatively if you only wish to make them stop you can set the flag as a trigger to remotely shut down their machines instead of yours. (They are pretty likely to stop once they figured out they now have a power button on their keyboard)
