To answer the question you asked (spoiler - it wont solve your issue)...
open a command prompt and type:
That list of directories is where Windows looks for executable files (after the current directory), working from left to right until it finds a matching
.exe or fails. If you insert a folder into your users' PATH variable before
c:\myscripts\shutdown.exe will be found first.
You may need to update both the system, and each users PATH variables to ensure your shutdown.exe is found, but this can be easily defeated. There are several methods to shutdown a computer via script or compiled code or even
rundll32.exe. Also this wont prevent absolute or relative paths to the real file.
Shutdown.exe is just a convenience, its not core to Windows shutting down. That said, I wouldnt try tampering with the file itself, while you might get your version to "stick", its only a matter of time before windows replaces it with the original.
Personally I would seriously look at group or local policy (depending on your network) to just revoke shutdown permissions for the problem users. It doesn't matter if a user runs the exe, if they dont have permission to shutdown the machine, the operation will fail.
If you cant lock down the systems for whatever reason your options are pretty limited.
Maybe instead of writing a shutdown replacement, run a script on a schedule (or write a service etc) on your file server that scans for any suspect files like .lnk, or .bat files and deletes them (or better yet take ownership and revoke access to the file so you can inspect / log who created it/which computer etc) and take any action.
You could take this even further with some code by using a filesystem watcher on the shared folder (from the file server itself!) your application will be notified of each new filename created in pretty much realtime and you can take whatever action. (like turning off the attackers computer :)