FolderRisk: Do not touch
AppPatch C:\Windows\AppPatch
Application compatibility databases (.sdb files) and fix libraries (shims) used by Windows.
What it’s for
AppPatch is home to the application compatibility infrastructure: indexed databases in the .sdb format describe the programs that need help. At launch, Windows consults them and applies either a help message (Apphelp) or a fix (Appfix, or “shim”) that hooks API calls so the application can run on the installed Windows version.
What it contains
- The compatibility databases that ship with Windows, including
sysmain.sdbanddrvmain.sdb. - The fix libraries (shims).
- A place for custom databases: Microsoft’s documentation uses
C:\Windows\AppPatchas an example path for a database installed withsdbinst.exe. - A custom database only takes effect once registered with
sdbinst.exe; dropping an.sdbfile here is not enough.
Risks and best practices
- Do not delete or replace the system databases: applications that depend on them stop starting properly.
- Install a compatibility fix with
sdbinst.exeor Compatibility Administrator, never by manual copy. To remove it, runsdbinst -u <file>.sdb. - Shims are also used for persistence: malware can hook in through a registered
.sdbdatabase. Review the installed databases regularly (command below). - Windows updates can replace the databases supplied by the system.
Useful commands
# Folder contentGet-ChildItem "$env:windir\AppPatch" -Force | Select-Object Name, Length, LastWriteTime
# Custom databases registered on the machineGet-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB' -ErrorAction SilentlyContinue