How to avoid DBA granted users (not SYS !) to bypass an after logon trigger?

Hello,

I have a list of DBA users (grant DBA performed to these users) and I want to prohibit connexions from a list of hosts for these users.

So I defined an after logon trigger which raises an exception if these users try to connect from the specified servers; the problem is that even if the trigger raises an exception (recorded in alert.log file) all DBA granted users bypass the trigger and are able to connect from these hosts.

If I build a customized DBA role, I know I have to exclude ADMINISTER DATABASE TRIGGER privilege from this role but are they other privileges to revoke in order to avoid these users bypassing the trigger?