Enabled local user accounts on this PC

#Requires -Modules Microsoft.PowerShell.LocalAccounts
# Enabled local user accounts, with the built-in Administrator (RID 500) and Guest (RID 501) marked. Read-only.
param(
    [switch]$All
)

Get-LocalUser |
    Where-Object { $All -or $_.Enabled } |
    ForEach-Object {
        $sid = "$($_.SID)"
        $builtIn = if ($sid -like '*-500') { 'Administrator (RID 500)' } elseif ($sid -like '*-501') { 'Guest (RID 501)' } else { '' }
        [pscustomobject]@{
            Name            = $_.Name
            Enabled         = $_.Enabled
            BuiltIn         = $builtIn
            PrincipalSource = $_.PrincipalSource
            Description     = $_.Description
            SID             = $sid
        }
    }

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

The Windows device you want to check, in 64-bit Windows PowerShell 5.1 (the LocalAccounts module isn't available in 32-bit PowerShell on a 64-bit system).

Reading the output

• The built-in Administrator and Guest accounts are recognised by their well-known RIDs (500 and 501 at the end of the SID), whatever they have been renamed to.
• Pass -All to include disabled accounts.
• PrincipalSource shows whether the account is local or a Microsoft account connected to the device.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.