What do you mean by "completely disabled"? As in, gone? Yeah, you can't do that. But I have often run environments where I star out the root password, disallowing any form of password-based authentication. As long as you have a method to boot single-user, this works well. Access to the root shell then requires SSH from a trusted host, or "sudo su" or the like from an account on the box itself. You might even be able to get away with disabling root's shell, but that's something I haven't tried.
What do you mean by "completely disabled"? As in, gone? Yeah, you can't do that. But I have often run environments where I star out the root password, disallowing any form of password-based authentication. As long as you have a method to boot single-user, this works well. Access to the root shell then requires SSH from a trusted host, or "sudo su" or the like from an account on the box itself. You might even be able to get away with disabling root's shell, but that's something I haven't tried.