SMB User Still Able To Write Despite Being Denied

You think that would be enough for Windows to figure it out? Lots of things such as drive mappings are (according to Internet sayings) per user session, but a service is not a regular user login/logoff session. Duplicati service doesn’t hear about UserB logging off, and maybe a service has its own “user session”. Documentation that I’ve been able to find isn’t clear enough. If you found exact info, what’s the source?

Regardless, it sounds like you think the option might have hope for original poster. I’m not set up to test.