This is one way..
I've been using this old UDF of mine in many in-house Winbatch applications to return a list of details about a user account... the email property you are after is just "mail" .. it is in the query string along with a few other properties.
Just pass the UDF the username you want to query.
;UDF/UDS START =================================================================================================== . . . . I F I C /-) /\/ ¯/¯ B Y T E
#DefineFunction GetUserInfoLDAP(samAccountName); pass UserName for samAccountName
UserInfoList = ""
; Use ADO to search the domain for all Groups.
objConnection = CreateObject("ADODB.Connection")
objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOOBject"
objConnection.Open("Active Directory Provider")
objCommand.ActiveConnection = objConnection
; Determine the DNS domain from the RootDSE object.
; Change strQuery OU to get ROOT for Users Query
ErrorMode(@OFF)
objRootDSE = GetObject("LDAP://RootDSE")
ErrorMode(@CANCEL)
If objRootDSE == 0 Then Goto CLOSEOBJECTS ; Return blank list and close objects if LDAP can't be found
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strFilter = StrCat("(&(objectCategory=user)(objectClass=user)(samAccountName=",samAccountName,"))")
strQuery = "<LDAP://":strDNSDomain:">;":strFilter:";l,title,telephoneNumber,displayName,department,mail,msExchHomeServerName;subtree"
; Enumerate all groups in the Queried OU Structure.
objCommand.CommandText = strQuery
objCommand.Properties("Page Size") = 100
objCommand.Properties("Timeout") = 30
objCommand.Properties("Cache Results") = @False
objRecordSet = objCommand.Execute
While objRecordSet.EOF == @FALSE
strLOC = objRecordSet.Fields("l")
strTIL = objRecordSet.Fields("title")
strTEL = objRecordSet.Fields("telephoneNumber")
strDNM = objRecordSet.Fields("displayName")
strDPT = objRecordSet.Fields("department")
strEML = objRecordSet.Fields("mail")
strEXS = objRecordSet.Fields("msExchHomeServerName")
UserInfoList = strLOC.value:@TAB:strTIL.value:@TAB:strTEL.value:@TAB:strDNM.value:@TAB:strDPT.value:@TAB:strEML.value:@TAB:strEXS.value
objRecordSet.MoveNext
EndWhile
:CLOSEOBJECTS
objRootDSE = 0
objCommand = 0
objConnection = 0
Return UserInfoList
#EndFunction
;UDF/UDS END =================================================================================================== . . . . I F I C /-) /\/ ¯/¯ B Y T E
samAccountName = "YOUR USER NAME"
Message("",GetUserInfoLDAP(samAccountName))