I use nbtscan as part of an enumeration for a internal security assessment. Even Angry IP Scanner has similar functionality.