Apologies, I forgot to add that Obewan is part of the DB_owner role for the DB, and is a sysadmin as server level.

So do you need to grant explicit perms for CREATE USER , etc or should the role membership be sufficient? (just trying to better my understanding)

I'll give the new script a go thanks - very much appreciated 😎