Datto EDR — Elevated Alert Volume — "Possible Shim Database Persistence via sdbinst.exe"

Update timeline

1. investigating Aug 27, 2026, 12:39 PM UTC

   We're seeing a spike in alerts for this rule caused by a recent change in Microsoft's default behavior. This is not indicative of active threats. A rule update is expected today. In the meantime, you can temporarily disable the rule under Policies → Detections → "Possible Shim Database Persistence via sdbinst.exe" to reduce noise until the fix is deployed. Should you need any additional questions or require assistance, please contact our support team at https://helpdesk.kaseya.com/hc/en-gb#/contact Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/

2. monitoring Aug 27, 2026, 01:31 PM UTC

   Microsoft's Program Compatibility Assistant (PCA) uses sdbinst.exe to manage application compatibility databases as part of routine Windows maintenance. The August Windows update introduced known gaming compatibility issues, and Microsoft's remediation of those issues triggered sdbinst.exe activity across affected endpoints simultaneously — matching the spike pattern we observed. The affected rule has been updated as of 9:15 AM EST and pushed to all tenants. Alert volumes should return to expected levels. If you disabled the rule as a temporary measure, it is safe to re-enable it under Policies → Detections → "Possible Shim Database Persistence via sdbinst.exe".

3. resolved Sep 03, 2026, 03:28 PM UTC

   This incident has been resolved.