When you are doing this in user space, are you elevating by chance? If so, maybe Duplicati is running non-elevated and that’s the difference.
If that’s not the case, then I would probably run SysInternals Process Monitor to log exactly where the access denied occurs.