This information is in AD. It is in the attribute msExchHomeServerName for each user object. This will enumerate the AD tree and return the name and Mailserver for each user.
'****************Setup ADSI connection and populate ADSI Collection************************************************
Set objADOconnADSI = CreateObject("ADODB.Connection")
objADOconnADSI.Open "Provider=ADsDSOObject;"
Set objCommandADSI = CreateObject("ADODB.Command")
objCommandADSI.ActiveConnection = objADOconnADSI
objCommandADSI.Properties("Size Limit")= 10000
objCommandADSI.Properties("Page Size")= 10000
objCommandADSI.Properties("Sort on") = "name"
objCommandADSI.CommandText = "<LDAP://saws.org>;(objectClass=user);" & _
"name,distinguishedname,msExchHomeServerName;subtree"
Set objRSADSI = objCommandADSI.Execute
do while NOT objRSADSI.EOF
if not isnull(objRSADSI.fields("msExchHomeServerName")) then
ExServer = right(objRSADSI.fields("msExchHomeServerName"),_
len(objRSADSI.fields("msExchHomeServerName"))_
-InStrRev(objRSADSI.fields("msExchHomeServerName"),"="))
wscript.echo objRSADSI.fields("name") & " - " & ExServer
end if
objRSADSI.MoveNext
loop
wscript.echo "Done!"
Hope this helps.