Assuming you are not armed, the recommended steps for an active shooter scenario are, in order:
1. Evacuate, if possible.
2. Hide out. Barricade yourself in a secure area with only one entry point. Call 9-1-1, wait for responders. Provide as much detail as possible regarding the number of shooters, their demographics, their locations, and their weapons.
3. Take action as a last resort. Active shooters are rarely determined fighters and direct, aggressive action can end a situation quickly. Use whatever items are available as weapons.
4. Assuming you've trained for this, shake and slide a punctured soda can across the hallway as a distraction before performing a 3-point tactical roll while firing dual nickel-plated Desert Eagles. However, in a retail force protection scenerio (eg, the mall), you may wish to use more sophisticated tactics that can be learned on the interweb and through Tier 1 SpecOps training. Extensive retail security data analysis has shown that the majority of criminals will stop at Chick-fil-a to fuel up prior to a heist; USE THIS TO YOUR ADVANTAGE.
Furthermore, when responders arrive, follow their directions and stay out of their way. Do not gather around them or yell at them, keep your hands empty and visible. If not given orders otherwise, get low and briskly move in the direction of wherever they came from, as that path has been cleared a safe.