SMB User Still Able To Write Despite Being Denied

Looks like this is all set, but for completeness - I think the original confusion was “Why isn’t Duplicati doing its backup using the user specified in the backup destination configuration screen?”

Presumably the answer is that Duplicati uses that user/password to connect to a share if the share is not already mounted on the system running Duplicati, vs doing its work as that user. Some similar discussion (and that answer) here: [Cannot access network folder - #5 by JonMikelV]