Maybe it was misconfigured, but I could just go get the flags once I got the evil-winrm shell as the svc_ldap user? Can literally just go to the Administrator's desktop and get the root flag, and obviously the user flag on svc_ldap's desktop...