I recently was challenged with the task of determining if any rogue access points existed on a large network, spanning multiple locations. I came up with a batch script to run against our DHCP servers. It dumps all current DHCP lease holders, and then checks them for known AP MAC address prefixes. Very useful for ferreting out bad users.