¿Has echado un vistazo a la página de manual?
¿No debería smbutil lookup [-w host] name
hacer el trabajo?
Global options are as follows:
-h Print a short help message.
-v Verbose output.
The commands and local options are:
help command
Print usage information about command.
lookup [-w host] [-t node_type] [-e] name
Resolve the given name to an IP address. The NetBIOS name server can be directly specified via
the -w option. The NetBIOS name type can be specified via the -t, the default is to lookup file
servers. For a complete list of name type please see "http://support.microsoft.com/kb/163409".
The NetBIOS names will be unpercent escaped out if the -e option is specified.
status [-ae] hostname
Resolve given hostname (IP address or DNS name) to NetBIOS workgroup and system name. All Net-
BIOS names will be displayed if the -a option is specified. All NetBIOS names will be percent
escaped out if the -e option is specified.
Para mí esto funcionó (reemplazando tu ejemplo):
smbutil lookup -w 172.16.0.10 -e domainPC | awk '/IP address of/ {print $5}'