What section of the NIST SP 800-171 2nd revision has the requirement: Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs?
Found in the Access Control section of the SP 800-171 document.
That requirement is found in the Access Control section.