Im trying to setup a Command Risk that whenever an AD User or Local Account logins to a Windows Server and tries to initiate a Restart/Shutdown on the server the command will not execute and the user will be disconnected.

Can someone teach me how to do this or post the Step-by-Step on how to do it? Thanks.