What you are encountering is the IIS Request Validation protection. By the looks of it, you have not actually found an XXS/HTML-injection vulnerability, but are only hammering the Request Validation protection that blocks your potentially bad requests.
Reflected XXS is hard to exploit, because of the different protection mechanisms in browser and in your case, also on the server side. See this question for chrome XXS protection.
So in order for you to probe if this server actually have reflected HTML-injection vulnerabilities, you have to either ask the administrator to disable request-validation, or try to use innocent data in your payloads.
If I recall correctly, IIS Request Validator allow you to try less harmful HTML tags. I do not remember what works, but you have to experiment. If that string is reflected, it is a good chance that the underlying application is vulnerable, but still hard to exploit due to the protections on web-server and web-browser.
In your particular case, you are sending characters that are blacklisted in the path segment of the URI.