Terminal Services security lockdown

I am trying to keep users from having access to key components and options on the terminal server, such as the shutdown option. Problem is that if I create a policy to block this than they can’t shutdown their win2k pro workstation. I eliminated most items in the profile but certain things you can’t get rid of without a group policy. I tried applying the group policy to just the server but that didn’t work since the policies that did take affect hampered the adminitstrator account as well even though I created a no overide policy for the admins. I assume these are buried in the registry somewhere. Any suggestions?