I found a utility called nmap that queries an IP address and returns the (likely) operating system. In my tests it has worked perfectly. I'd like to embed it into a vbscript and call it as a function and return only the operating system version.
Starting Nmap 6.25 ( http://nmap.org ) at 2013-04-25 13:30 Central Daylight Time Initiating Ping Scan at 13:30 Scanning servername (18.104.22.168) [4 ports] Completed Ping Scan at 13:30, 0.28s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 13:30 Completed Parallel DNS resolution of 1 host. at 13:30, 0.02s elapsed Initiating SYN Stealth Scan at 13:30 Scanning servername (22.214.171.124) [1000 ports] Discovered open port 139/tcp on 126.96.36.199 Discovered open port 3389/tcp on 188.8.131.52 Discovered open port 80/tcp on 184.108.40.206 Discovered open port 445/tcp on 220.127.116.11 Discovered open port 3306/tcp on 18.104.22.168 Discovered open port 135/tcp on 22.214.171.124 Discovered open port 1025/tcp on 126.96.36.199 Discovered open port 1066/tcp on 188.8.131.52 Discovered open port 4445/tcp on 184.108.40.206 Completed SYN Stealth Scan at 13:30, 0.40s elapsed (1000 total ports) Initiating OS detection (try #1) against servername (220.127.116.11) Nmap scan report for servername (18.104.22.168) Host is up (0.014s latency). Not shown: 991 closed ports PORT STATE SERVICE 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 1025/tcp open NFS-or-IIS 1066/tcp open fpo-fns 3306/tcp open mysql 3389/tcp open ms-wbt-server 4445/tcp open upnotifyp Device type: general purpose Running: Microsoft Windows 2003 OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2 OS details: Microsoft Windows Server 2003 SP1 or SP2 Network Distance: 7 hops TCP Sequence Prediction: Difficulty=262 (Good luck!) IP ID Sequence Generation: Incremental Read data files from: I:\Scott\Utilities\nmap-6.25 OS detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 2.30 seconds Raw packets sent: 1020 (45.570KB) | Rcvd: 1020 (41.434KB)