Does anyone have a way to prevent or lockdown the ability for Endpoint Central to restart a specific Windows server?  I have tried local security policy changes but since this is initiated by nt authority on behalf of, those policies don't work. 

I have some techs that need Endpoint Central Admin rights but they keep restarting key servers that have a more granular maint window than our other servers.