I use KiXtart to access DNS and DHCP information, but to be honest it doesn't get you much further than what you have.

The technique that you choose really depends on how you are going to use the information.

Here is a simple example of how to query AD, kludged from examples found around the board - in your case you can use the operatingSystem property to select the computers (XP) to act on.
 Code:
BREAK on
 
$objConnection = CreateObject("ADODB.Connection")
$objCommand =   CreateObject("ADODB.Command")
$objConnection.Provider = "ADsDSOObject"
$objConnection.Open("Active Directory Provider")
$objCommand.ActiveConnection = $objConnection

$objCommand.CommandText = 
   "SELECT Name,OperatingSystem FROM " 
   + "'LDAP://"
   + GetObject("LDAP://"+GetObject("LDAP://rootDSE").Get("defaultNamingContext")).distinguishedName
   + "'"
   + " WHERE objectCategory='computer'"
 
$objCommand.Properties("Page Size").Value = 100
$objCommand.Properties("Search Scope").Value = 2
$objCommand.Properties("Cache Results").Value = (not 1)
 
$objRecordSet = $objCommand.Execute()
$objRecordSet.MoveFirst
while not $objRecordSet.EOF
   $objRecordSet.Fields("Name").Value+" "+$objRecordSet.Fields("operatingSystem").Value+@CRLF
   $objRecordSet.MoveNext
Loop
 
Exit 0