I'm writing a script that will help me "port" privileges for Windows security accounts of one domain over to equivalent accounts on a different domain. You must first check to see whether any affected databases are read-only. If they are, you must take them out of read-only mode, first, before you revoke or grant any privileges to the database. I am using this procedure to figure out which databases are read-only.