With nmap I found a RDP service in port 3389.
Using any RDP client Im able to connect as Administrator without password. In the windows desktop, I see the flag in a notepad.