Shutdown policy problem.

We are experiencing some strange problems with our domain policies. Our XP users were unable to shutdown their machines locally. It would let them log out and then they could hit shutdown after CTRL-ALT-DEL.

We attempted to add the Domain account for these users to the local administrator account of the XP desktops but they still cannot shut the machine down.

We put in a policy that allowed them to shut down the machines from the domain level. (User right’s and assignments-Shut down the system) The problem now is that they can shut down our Citrix servers as well.

The Shutdown the machine remotely policy is VERY restrictive. There are only 5 users that this policy applies to.

How can I give these users the ability to shutdown thier desktops without letting them shutdown my servers?