You can use Kix2001 to query the services on a remote NT box. It is not easy though.

Look at this thread:

ADSI - Services