Microsoft's Program Compatibility Assistant (PCA) uses sdbinst.exe to manage application compatibility databases as part of routine Windows maintenance. The August Windows update introduced known gaming compatibility issues, and Microsoft's remediation of those issues triggered sdbinst.exe activity across affected endpoints simultaneously — matching the spike pattern we observed.
The affected rule has been updated as of 9:15 AM EST and pushed to all tenants. Alert volumes should return to expected levels.
If you disabled the rule as a temporary measure, it is safe to re-enable it under Policies → Detections → "Possible Shim Database Persistence via sdbinst.exe".
Posted Aug 27, 2026 - 09:31 EDT
Investigating
We're seeing a spike in alerts for this rule caused by a recent change in Microsoft's default behavior. This is not indicative of active threats. A rule update is expected today.
In the meantime, you can temporarily disable the rule under Policies → Detections → "Possible Shim Database Persistence via sdbinst.exe" to reduce noise until the fix is deployed.