It can be fairly difficult to track system administrators who remotely login as root. Here's a way to prevent that particular activity, especially in an environment that requires stringent auditing.
vi /etc/default/login #/dev/console /dev/console :wq! (saves and quits)
As you can see, the comment prefacing /dev/console has been removed. A user should not be able to remotely login as root.