I would first take a look at the imports from C:\WINDOWS\system32\shutdown.exe I noticed from a dumpbin that it has some privilege calls to ntdll.dll as well as the obvious kernel32.TerminateProcess. I am assuming in order to shutdown the system, it elevates its privilege level to something higher than the main system process, and then executes a terminate process on it, but that's just a guess.
Drop shutdown.exe into IDA and see what calls you come up with.
If none of these hit you may need to go to a lower level you could try and find the related service ID's and set a breakpoint on INT 2E with the correct service id as a condition...
Note: Registration is required to post to the forums.