What can I use to locate down-level clients in Windows 95? Do all Win95 clients register with WINS?

I'm working in a Windows 2000 environment (mid-migration) and I'm researching mechanisms for locating down-level clients -- specifically Windows 95. This is explicitly a double check to ensure that there are no more down-level clients still out there.

The Domain Master browser will know about these boxes, but I don't know of any way to interrogate it. Do all Win95 clients register with WINS? Can this be interrogated in order to find them all? Owing to my clients' foibles, admin access is not taken as a given.

There are 22K+ hosts out there. I've been working this through DNS so far, but hope to find something more accurate.
By default, Windows 95 clients register with WINS, although this option is easily changed by editing TCP/IP properties. Assuming you have policies set not to allow this, it should be possible to interrogate the systems in question using WINS.