Just curious what issue the company has with the light weight forwarder? Are there any changes Splunk can make to the LWF to make it compliant?
Anyway, here are a few ideas:
.bat scripted input that uses ssh to login to Linux and execute the df -h command. You'd have to install a CLI friendly ssh client on the Windows box. I'd also recommend distributing keys rather than hard-coding credentials in the script.
same kind of scripted input as above, but using snmp polling. Much more light-weight. Look at something like Cacti.
you can samba mount the disk and use Windows' native methods such as perf counters. Probably the fastest but least production-ready solution.
Would company policy allow you to put your own cron script on the Linux box that runs df -h | netcat?
Additional suggestion based Dan's 1st suggestion. Rather than using df -h, you could use the df.sh script that's bundled in the unix app's bin folder (if you allowed to place that on the linux machine). I think you could use the plink tool in that comes with Putty (ssh client for windows). You could also use the Putty Agent to store ssh keys for the whole auth thing.