The following script will let you query remote IIS server and return a list of the application pools on that server.

It is assumed that you run the script with domain account that is a member of Administrators group on the remote computer but the script can be easily modified to use other credentials.

This works on IIS 6 and IIS 7 after installing IIS 6 WMI Compatibility Features.

Scripts takes a server name as a parameter:

PS >.\scriptname.ps1 server_name

Get-WmiObject -Authentication PacketPrivacy -Impersonation Impersonate
                       -ComputerName $args[0] -namespace "root/MicrosoftIISv2"
                       -class IIsApplicationPool |
Select-Object -property @{N="Name";E={$name = $_.Name; $name.Split("/")[2] }} |
Format-Table