Remote Port Query
Replace Portqry with zenmap or nmap
[source]
@echo off
:start
for /f %%I in (serverlist.txt) do call :run %%I
goto :end
:run
copy /y PortQry.exe \\%1\admin$
psexec.exe \\%1 "c:\windows\PortQry.exe" -local -l \\hostname\c$\%1.log
goto :eof
[/source]