Datto EDR — Elevated Alert Volume — "Possible Shim Database Persistence via sdbinst.exe"

Update timeline

1. investigating Aug 27, 2026, 12:39 PM UTC

   We're seeing a spike in alerts for this rule caused by a recent change in Microsoft's default behavior. This is not indicative of active threats. A rule update is expected today. In the meantime, you can temporarily disable the rule under Policies → Detections → "Possible Shim Database Persistence via sdbinst.exe" to reduce noise until the fix is deployed. Should you need any additional questions or require assistance, please contact our support team at https://helpdesk.kaseya.com/hc/en-gb#/contact Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/

2. monitoring Aug 27, 2026, 01:31 PM UTC

   Microsoft's Program Compatibility Assistant (PCA) uses sdbinst.exe to manage application compatibility databases as part of routine Windows maintenance. The August Windows update introduced known gaming compatibility issues, and Microsoft's remediation of those issues triggered sdbinst.exe activity across affected endpoints simultaneously — matching the spike pattern we observed. The affected rule has been updated as of 9:15 AM EST and pushed to all tenants. Alert volumes should return to expected levels. If you disabled the rule as a temporary measure, it is safe to re-enable it under Policies → Detections → "Possible Shim Database Persistence via sdbinst.exe".

3. resolved Sep 03, 2026, 03:28 PM UTC

   This incident has been resolved.

4. postmortem Sep 08, 2026, 09:21 PM UTC

   **Datto EDR - Mass Detection on Windows Behavior – 2026-08-27** **Summary** Between **2026-08-27 08:00 UTC** and **2026-08-27 16:00 UTC**, Datto EDR customers experienced an elevated volume of detections generated by the **Possible Shim Database Persistence via sdbinst.exe** detection rule. The increase in alerts created additional operational overhead for customers and analysts reviewing alerts. No service outage occurred, and endpoint protection functionality remained operational throughout the event. The issue was resolved after the detection rule was updated to account for a newly observed legitimate Windows operating system behavior. **Root Cause** A legitimate Microsoft Windows behavior involving **sdbinst.exe** and the file path **C:\\Windows\\appcompat\\cloudsdb\\apppatch.sdb** was not covered by the existing exclusions within a Datto EDR detection rule. A change in Microsoft's behavior matched the criteria of the rule **Possible Shim Database Persistence via sdbinst.exe**, resulting in a higher-than-expected volume of detections. The rule logic was updated to properly account for the newly observed behavior and eliminate the unintended detections. **Incident Timeline** * **Identified:** 2026-08-27 08:00 UTC \(customer reports and alert volume increase identified\) * **Public Notification:** 2026-08-27 11:00 UTC \(incident escalated to Product and Detection Engineering teams and communications initiated\) * **Resolved:** 2026-08-27 16:00 UTC \(updated rule deployed and alert volume returned to expected levels\) **Preventative Measures** To reduce the likelihood and impact of similar incidents in the future, we are implementing the following improvements: **Enhancements to Monitoring and Alerting** * Implement monitoring and baselining for individual detection rules to identify abnormal spikes in alert volume more rapidly. * Develop internal metrics that provide visibility into detection trends and anomalous rule behavior before large-scale customer impact occurs. **Enhancements to Incident Management and Response** * Improve escalation workflows for significant detection-volume increases to ensure appropriate engineering resources are engaged as quickly as possible. * Continue refining response procedures for detection-rule tuning and validation when unexpected platform or operating system behavior changes are observed. **Detection Content Improvements** * Enhance detection engineering review processes to account for evolving operating system behaviors and newly introduced legitimate execution patterns. * Expand validation and exclusion testing for detection rules where operating system updates may introduce behavior changes that resemble suspicious activity. **Customer Impact** * Product Affected: **Datto EDR** * Impact Type: **Increased detection volume / mass alerts** * Service Availability: **No outage** * Security Protection Status: **Protection remained active and operational** * Customer Impact: Customers experienced increased alert volume requiring additional review and operational effort. This incident has been fully resolved, and Datto EDR continues to operate normally.