It's straightforward to permit SSH access but not shell logins.... if you can administer user and group settings. I guess stuff like scponly (http://freecode.com/projects/scponly) is useless if you're running Windows server-side.

Not that I'd like to encourage it, but there could be a sudo in FTP, along the lines of WU-FTPd's infamous support for a "SITE EXEC" command.