In case anyone else ever needs this…
System.IO.Directory.GetFiles(@\\.\pipe\) will return an array of named pipes.
and…
the named pipes for SQL user instances always contains @"\tsql\query"
so,…
You can get to something like @"Data Source=\\.\pipe\XXXXXXXX-XXXX-XX\tsql\query; Integrated Security=True;Connect Timeout=30;";
and..
“SELECT * FROM sysdatabases” will return all the attached databases from that ‘user instance’ of SQL