Attributes to Prevent User From Rebooting, Shutting Down, and Ejecting Drives

I've been googling this for the last few hours, and (while I *have* found some interesting solutions for other projects,) I must not be using the right search terms. I was told that you could deny a network user the ability to shut down or reboot the machine, or to eject volumes, using Attributes in Workgroup Manager. I looked through the default attributes, but I'm pretty sure I don't want to start messing around with those settings without some prior knowledge. Any pointers?