Here's what i found on my system, I was having a similar issue, more so my other administrators playing pratical jokes.
In the security logs, look for event ID "4674" task category "sensitive privilage use"
there may be multiple entries of this particular log and i'm currently looking how to narrow it down, but i digress. In the General tab in the bottom window it will state "an operation was attemted on a privileged object" and under SUBJECT, it will give you the security ID and account name of the account that executed the psshutdown. Under OBJECT it will have object name "psshutdownsvc". Doesn't list the computer name that executed, but you'll at least get a user name.
This thread seems kind of old, but if anyone is looking for how to find the culprit as i was, hope this helps.
"you speak out of turn, but the truth spills from your mouth"
