Hi John,
This must be done from a Group Policy shutdown script. Logoff would be too soon (as you indicate), and won't have the correct permissions.
How this needs to be addressed (and by whom) is still a topic for discussion 
BTW, what Horizon version are you on?