Ransomware canary

Presumably leaving the path empty permanently would disable the feature?

How does it behave if a client removes or deletes an entire user account? (Transient & short term users).