There may be a number of Terminal Services or Remote Desktop Enterprise License Servers in a domain. As these enterprise license servers are registered in Active Directory they can be located with an LDAP query.

Using LDP.EXE:

- Select Connection | Connect
- Click OK
- Select Connection | Bind
- Click OK
- Select Browse | Search
- Select the Base DN of CN=Configuration...
- Enter the Filter: (&(objectClass=licensingSiteSettings)(cn=TS-Enterprise-License-Server))
- Select Subtree as the Scope
- Enter siteServer for the Attributes
- Click Run

Using VBScript:

' LDAP query of configuation partition
Set objADsRootDSE = GetObject("GC://RootDSE")
strADsPath = "LDAP://" & objADsRootDSE.Get("configurationNamingContext")
strFilter = "(&(objectClass=licensingSiteSettings)(cn=TS-Enterprise-License-Server))"
strAttributes = "cn,ADsPath,siteServer"
strScope = "subtree"

' Configure ADODB connection
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Open "Provider=ADsDSOObject;"
Set adoCommand = CreateObject("ADODB.Command")
adoCommand.ActiveConnection = adoConnection
adoCommand.CommandText = "<" & strADsPath & ">;" & strFilter & ";" & strAttributes & ";" & strScope
Set adoRecordset = adoCommand.Execute

' List servers
While Not adoRecordset.EOF  
    For Each licenseServer in adoRecordset.Fields("siteServer").Value
        Wscript.Echo licenseServer
    Next
    adoRecordset.MoveNext
Wend

adoConnection.Close

Terminal Services Licensing service discovery
http://support.microsoft.com/kb/301932