The VbScript below demonstrates how subnet information might be retrieved from Active Directory. It is possible to use a search using to return this information (for objectClass=subnet). This method connects to the subnets container and loops through the contents returning the network address and mask length in a Dictionary object.

Function GetADSubnets
    ' Return Type: Array
    Dim objRootDSE : Set objRootDSE = GetObject("LDAP://RootDSE")
    Dim objSubnets : Set objSubnets = GetObject("LDAP://CN=Subnets,CN=Sites," & _
    Dim arrSubnets() : Dim i : i = 0
    For Each objSubnet in objSubnets
        ReDim Preserve arrSubnets(i)
        arrSubnets(i) = objSubnet.Get("name")
        i = i + 1
    GetADSubnets = arrSubnets
End Function

Usage example

WScript.Echo Join(GetADSubnets, vbCrlf)