How can you discover where SQL Servers are in your enterprise environment?
There's always the handy sqlcmd -L, but how can you know you've found everything?
How about this for starters:
csvde -f out.csv -r "(&(objectClass=Computer)(servicePrincipalName=*SQL*))" -l name,servicePrincipalName
It's left as an exercise for the reader to find the intersection of the results of the above tools, along with validation.