Wow. Can't believe it's close to 3 months since posting - just shows how busy life can get sometimes. Anyway, I thought I'd share this script which will tell you how many domain-joined Virtual Server hosts are currently running in your organization. It takes advantage of the SCP (Service Connection Point) marker in Active Directory which was introduced in Virtual Server 2005 R2 SP1 (currently in Beta - not too much longer to wait before release). 

On Error Resume Next
Const SCP = "MS Virtual Server"
 
' Add as many lines as needed for the domains in your org. 
DoQuery "DC=yourdomain,DC=com", "YOURDOMAIN", SCP
 
Sub DoQuery(szDomainDN, szDomainShortName, szSCP)
 
    Set oConnection = CreateObject("ADODB.Connection")
    Set oCommand = CreateObject("ADODB.Command")
    oConnection.Provider = ("ADsDSOObject")
    oConnection.Open "Ads Provider"
    oCommand.ActiveConnection = oConnection
    oCommand.Properties("Page Size") = 99
    oCommand.Properties("Searchscope") = &H2 'ADS_SCOPE_SUBTREE
    oCommand.Properties("Chase Referrals") = &H60 'ADS_CHASE_REFERRALS_ALWAYS
    oCommand.CommandText = _
       "select distinguishedName from 'LDAP://" & _
       szDomainDN & "' " & _
       "where objectCategory='serviceConnectionPoint' " & _
       "and cn='" & szSCP & "'"
    Set oRecordSet = oCommand.Execute
    If Err Then
       wscript.echo _
           "ERROR: Unable to find Domain Rooted at: " & _
            szDomainDN
       exit sub
    End If
 
    If Not oRecordSet.EOF Then
       wscript.echo szDomainShortName & ":" & _
                    oRecordSet.RecordCount
 
       ' If you want to enumerate the machine names, 
       ' uncomment this block of code
       'oRecordSet.MoveFirst
       'Do Until oRecordSet.EOF
       '    szNodeName = _
       '      oRecordSet.Fields("distinguishedName")
       '    'Trim "CN=<szSCP>,CN="
       '    szNodeName = _
       '      mid(szNodeName, InStr(szNodeName,",CN=")+4) 
       '    'Trim the domain DN
       '    szNodeName = _
       '      Left(szNodeName,InStr(szNodeName,",")-1)
       '    wscript.echo szNodeName
       '    oRecordSet.MoveNext
       'Loop
    else
       wscript.echo szDomainShortName & ": 0"
    end if
 
    set oRecordSet = Nothing
    set oCommand = Nothing
    oConnection.Close
    set oConnection = Nothing
 
End Sub

Either download a text file with the contents here and rename it, or copy the above code into a file "FindServers.vbs". Edit the call to "DoQuery" at the top to put in the appropriate domains for your organization. If you want a list of the machine names as well, uncomment the code-block starting "oRecordSet.MoveFirst" and ending "Loop". To run the script, from a command-line, type "cscript FindServers.vbs".

Cheers,
John.