You find a file that won’t let you do what you want, despite what looks like enough permission. First, have a look at what’s actually on the ACL:

icacls .\file.txt
whoami /groups

For a lab file where CHADDUFFEY\chad should have Modify access:

icacls .\file.txt /grant 'CHADDUFFEY\chad:M'
icacls .\file.txt

Replace the account with the one you’re fixing. /grant adds to existing explicit grants; /grant:r replaces that account’s explicit grants. M is Modify. F also includes control over permissions and ownership, which is usually more than an editor needs.

The original reminder here used cacls to grant Everyone Full Control. That’s a good way to make the immediate error disappear while leaving a much bigger permission change behind. icacls replaces the deprecated cacls, and targeting the actual account keeps this understandable.

If it still fails, check inherited entries ((I) in the output), deny entries, and the token the application is using. A locked file or a read-only attribute can also look like a permissions problem. And you still need permission to change the DACL; icacls doesn’t confer that just by being run.

Microsoft’s icacls reference has the access masks and inheritance flags.