OK, I posted the question about ping.net earlier, so this one caught my
eye.

I tried LINKEDIT LISTPROG for NETTOOL.NET, and got CAPABILITIES   : BA,
IA, PM, which doesn't work. So I took Steve Dirickson's list, and
starting adding likely candidates for NETTOOL to what I am using for
PING. What finally worked for me is DI,NA,NM,SF,BA,IA,PM,MR,DS,PH. So,
start with this, and try Steve's suggestion of taking them away, one at
a time, to see what it really wants. I tried taking away BA, and NETTOOL
gave me the "***(ERROR 9-51)User has insufficient capabilities to run
this program". That seems odd to me, so I am reluctant to offer
suggestions as to what it wants, and have to get back to a debugging
task...

But I do take this issue seriously; please post what you find. Anyone
want to start a thread on capabilities and security? This is exactly why
I asked about ping; the user that needs to perform ping testing does not
need to be able to do much else.