After engaging a WYSE engineer, looks like this functionality to block shut downs / sign-offs is not currently available through WTOS using a WNOS, $MAC or $user ini file. Will try to get a change request submitted to allow for “Sign-off Account” to be disabled similar to the lock terminal functionality.