1:
Set colItems = objWMIService.ExecQuery("Select ds_sAMAccountName, ds_homeDirectory From ds_user WHERE ds_homeDirectory IS NOT NULL")
ADO can return any attribute you want to, but as you're already using the above WMI method, then the WQL to return users with a particular home directory would be as below.
% is the wildcard character in WQL.
Tony
Set colItems = objWMIService.ExecQuery("Select ds_sAMAccountName, ds_homeDirectory From ds_user WHERE ds_homeDirectory LIKE '%server%'")