i did the above and the shutdown button is still available when are connecting to the box.
i have a OU called Terminal Services - inside you'll find terminalservices group and the server object. terminal services group has domain users group under members and all users are part of the domain users group.
logically the policy should apply to users logging on to the terminal server...but the shutdown button is still available and anyone can shutdown the server.
i'm not sure what to do next...