Running a custom PowerShell script via RTR's runscript command is gated by the 'Custom Scripts' setting in the applicable Response policy. If Custom Scripts is disabled in that policy, even a user with the Active Responder role cannot execute custom scripts on the host. Put-and-Run (D) governs uploading and executing arbitrary files/binaries (the put and run commands), not runscript custom scripts, so it does not explain a blocked script. The Active Responder role can run permitted custom scripts, so requiring the Administrator role (C) is not the gating factor, and Script-Based Execution Monitoring (A) is a prevention-policy detection setting, not an RTR execution permission.
Community Discussion