If you want to find all the instances on the AD domain, hidden or not you can use the code which Aaron and I put together for my book "Securing SQL Server". It'll do a dump from AD for all the machines in the domain then go through the list looking for machines which have the SQL Server services installed. As long as the machine is turned on and connected to the network this script will find the services. This does need to be run by a domain admin.

$objDomain = New-Object System.DirectoryServices.DirectoryEntry

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher

$objSearcher.SearchRoot = $objDomain

$objSearcher.Filter = ("computer")

$objSearcher.PropertiesToLoad.Add("name")

$Computers = $objSearcher.FindAll()

foreach ($machine_name in $Computers | sort computername )

{

$sql_servers = get-wmiobject -class win32_service -computer $machine_name

$sql_servers | where { $_.name -like 'MSSQL$' -or $_.name -eq 'MSSQLSERVER'} | select name

}