AC.2.007 — Prevent Non-Privileged Users from Executing Privileged Functions

CMMC Level 2SPRS if unmet: -1MEDIUM priority~6h to implement

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

What AC.2.007 means in plain English

Regular employees should not be able to do things that only administrators are supposed to do — like installing software, changing system settings, or disabling your antivirus. And when an admin does perform one of these special actions, the system should keep a record of it so you can look back and see who did what and when.

The assessment question

“Are standard user accounts blocked from installing software or changing system security settings, and does your system maintain logs that record when administrator-level actions are performed?”

How to implement AC.2.007

Ensure all employees are configured as "Standard User" in Windows (not Administrator): Settings > Accounts. Standard users will be prompted for admin credentials if they attempt to install software or change system settings.
Enable Windows audit logging for privileged operations: open Local Security Policy (secpol.msc) > Advanced Audit Policy Configuration > Privilege Use > "Audit Sensitive Privilege Use" — set to Success and Failure.
In Microsoft 365 GCC, enable Unified Audit Log (UAC): go to the Microsoft Purview compliance portal > Audit > Start recording user and admin activity. This captures all admin actions.
Use Windows Defender Application Control (WDAC) or AppLocker (both free, built into Windows 10/11 Enterprise or via Group Policy) to create an allowlist of approved software, preventing unauthorized installs.
Review audit logs monthly — set a recurring calendar reminder to spend 30 minutes reviewing the Microsoft 365 Unified Audit Log for unusual privileged activity.

Evidence your assessor will ask for

Screenshot confirming standard users are not in local Administrators group
Windows Audit Policy configuration showing privileged use auditing enabled
Sample audit log entries showing privileged function executions
Microsoft 365 Unified Audit Log activation screenshot
Written policy stating non-privileged users may not execute privileged functions

Does AI prompt monitoring help with this control? Honestly, no.

AC.2.007 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Access Control