You would do it through the per computer configuration, however when you add the GPO you would apply the security settings to a group so you could apply the permissions to a particular set of users, leaving your power users the capability to reboot ect as required
To allow power users to reboot their workstations, make sure your Computers and Servers are in different OUs and link the GPO I mentioned to the Servers OU.
Adam, your right but you can also remove the run command in that group as well. Or you can edit the security properties of the shutdown.exe and deny it for any user you want.
Hey Adam, just so you know... I agree with you and had I saw your post before I posted, I wouldn't have posted my solution but geeze you don't have to be so snarky dude.
David Johnson, CD
A helpdesk user doesn't need for a lot of tasks to logon to the server, they can do all of the management through RSAT tools.