You can disable it for both GDM and from the menu when logged in.
Edit /usr/share/polkit-1/actions/org.freedesktop.consolekit.policy
and where ever it says
<allow_active>yes</allow_active>
change that to
<allow_active>auth_admin_keep</allow_active>
So the file will look like this:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<!--
Policy definitions for ConsoleKit
-->
<policyconfig>
<action id="org.freedesktop.consolekit.system.stop">
<description>Stop the system</description>
<message>System policy prevents stopping the system</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>no</allow_active>
</defaults>
</action>
<action id="org.freedesktop.consolekit.system.stop-multiple-users">
<description>Stop the system when multiple users are logged in</description>
<message>System policy prevents stopping the system when other users are logged in</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>no</allow_active>
</defaults>
</action>
<action id="org.freedesktop.consolekit.system.restart">
<description>Restart the system</description>
<message>System policy prevents restarting the system</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.consolekit.system.restart-multiple-users">
<description>Restart the system when multiple users are logged in</description>
<message>System policy prevents restarting the system when other users are logged in</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
</policyconfig>
Note: You don't have to change the last two sections (they affect restarting), but I'm assuming if you don't want someone shutting down the computer, you don't want them restarting it either.
To do this faster, you could create two version of this file (one that allows normal users to shut down the computer, and one that doesn't) somewhere in your home directory and have a script that copies one of them to
/usr/share/polkit-1/actions/
.