Sorry if we were talking at cross-purposes... my bad...

I think the best way for the future is to run p0f at certain places on the network to capture live machines passively. But that requires pre-planning and precludes consultants and contractors coming in and doing a thorough and accurate auto-discovery of a network.