'# From the book "Managing Enterprise Active Directory Services"
'# ISBN: 0-672-32125-4

ON ERROR RESUME NEXT
Dim ADsPath, user, passwd, server
server = "dc1"
user   = "administrator@xyz.com"
passwd = "password"

Dim rootDSE
Set rootDSE = GetObject("LDAP://" & strServer & "/RootDSE")
ADsPath =  "<GC://" & server & "/" & _
              rootDSE.Get("rootDomainNamingContext") & ">;"

Dim criteria, properties, scope
criteria = "(ObjectClass=domainDNS);"
properties = "Name;"
scope = "SubTree"

Dim objConnect, objCommand, objRecordSet
Set objConnect = CreateObject("ADODB.Connection")
objConnect.Provider = "ADsDSOObject"
objConnect.Open "Active Directory Provider", user, passwd
Set objCommand = CreateObject("ADODB.Command")
Set objCommand.ActiveConnection = objConnect
'Set the query string
objCommand.CommandText = ADsPath & criteria & properties & scope
'Execute the query
Set objRecordSet = objCommand.Execute
If Err.Number then
    Wscript.Echo "Error occurred during the query: " & Err.Description
    Wscript.Quit
End If

objRecordSet.MoveFirst
While Not objRecordSet.EOF
    Wscript.Echo objRecordSet.Fields(0).Value
    objRecordSet.MoveNext
Wend