Powershell has an ActiveDirectory plug-in, which can run on client's machines w/permission that you set once.