The ThinKioskUser account is only a member of the ‘Users’ group, hence the restart or shutdown might not be a privilege assign to it.

To overcome this limitation please add the Users group to the "Shut down the system" policy, as illustrated in the screen shot below.