This yields a list of all groups with the ability to shut down the computer:
Windows Key -> in search type "Local Security Policy" and open the program.
Local Policies-> User Rights Assignment -> Double-click Shut down the system.
The Guest account is (probably) in one of those groups - I would guess 'Users' if it is not explicitly named in the list - verify group membership by running 'compmgmt.msc'
Of note: The guest account is, by default, a member of the 'YourDomain\Domain Users' group (if memory serves) which is a member of the Users Group.
If you want to verify group membership, running this command from powershell should spit it out assuming that you have the powershell activedirectory module:
Get-ADPrincipalGroupMembership guest | select name
If using a command prompt is still allowing the activity, you can (and probably should) disable the command prompt for the guest account using gpedit.msc - it is under Group Policy->user configurations->administrative templates-> system -> "prevent access to the command prompt"