After reading the MikroTik Wiki on AAA with Radius, some googling on setting up Windows Server IAS for Remote Access Policies, I worked out this...
When you create the two Remote Access Policy Profiles on the windows server (one for full access and one for read access), in the Advanced tab of the profile, click on add a 'Vendor-Specific' Attribute. On the Multivalued Attribute Information window, add an attribute value using vendor code 14988, then under 'Configure Attribute' input 3 as the vendor-assigned attribute number, the format as 'String' and the value as "full". For the second "read" profile, input "read".
Ron Touw - Mikrotik Certified Trainer
LinITX.com - MultiThread Consultants
Get your MikroTik RBs and Training: http://linitx.com/category/166
Largest Official UK MikroTik Distributor
IRC channel: #routerboard on irc.z.je (IPv4), 6.irc.z.je (IPv6)