I have created a password file using orapwd utility.

d:\orapwd file=orapass.pwd password=test entries=5

The parameter REMOTE_LOGIN_PASSWORDFILE=exclusive

I have removed all user entries from the Operating System Group ORA_DBA.

Still when i connect using
connect sys/differentPassword as sysdba;

it allows me to connect, which it should not.

Can anyone explain why it uses OS authentication and not the password file.