<p>I know I could just ask, but that would involve bureaucratic entanglements.</p>

I believe that on an AD network that is DNS enabled the root zone points at all the AD servers.  So, for instance, if your official AD username is joebloe@company.ad, doing an nslookup of company.ad from cmd.exe will tell you all the IPs of the controllers (and hence all the IPs you could use for LDAP).
This is edited to change the zone name, but one my work system:
```
```
C:\Documents and Settings\jj33>nslookup companyname.ad
Server:  palpatine.companyname.ad
Address:  172.19.1.3

Name:  companyname.ad
Addresses:  172.16.3.2, 172.16.6.2, 172.19.1.3, 172.16.7.9
          172.19.1.14, 172.19.1.11
C:\Documents and Settings\jj33>
```
```
On my (XP) machine, this shows me my AD domain:
Right click "My Computer"
Select "Computer Name" tab
See "Domain:" field