I know two reasons: Because you did not want to check the set of capabilities your application actually needs you selected all 13 that you can get through Express Signed. AND you have a DLL which you load to a system process so your applications needs All-TCB (all except TCB capability)....