lock the OS accounts. dont let anyone log in with the dba group

The point of os authentication is that you can do this. if you dont want people doing it - dont let them