you can query the dhcp servers, but there are 2 problems with that
1. I can't find a method to automatically determine the names of all the dhcp servers in a network
2. If the target PC's lease has expired, the server dumps the record (and it's MAC)
If you look at remote execution manager, I have 3 methods employed... ini file, DHCP, and SMS. But SMS worked easiest.
I'm thinking about dumping the hotfix installer, and just make it a generic remote execute...
