The Domain Master browser will know about these boxes, but I don't know of any way to interrogate it. Do all Win95 clients register with WINS? Can this be interrogated in order to find them all? Owing to my clients' foibles, admin access is not taken as a given.
There are 22K+ hosts out there. I've been working this through DNS so far, but hope to find something more accurate.
By default, Windows 95 clients register with WINS, although this option is easily changed by editing TCP/IP properties. Assuming you have policies set not to allow this, it should be possible to interrogate the systems in question using WINS.
This was first published in December 2002