Members of local privileged groups on this PC

#Requires -Modules Microsoft.PowerShell.LocalAccounts
# Members of the built-in local privileged groups, found by well-known SID. Read-only.

$groupSids = @(
    'S-1-5-32-544'   # Administrators
    'S-1-5-32-555'   # Remote Desktop Users
    'S-1-5-32-580'   # Remote Management Users
    'S-1-5-32-551'   # Backup Operators
    'S-1-5-32-578'   # Hyper-V Administrators
)

foreach ($sid in $groupSids) {
    $group = Get-LocalGroup -SID $sid -ErrorAction SilentlyContinue
    if (-not $group) { continue }
    Get-LocalGroupMember -Group $group |
        ForEach-Object {
            [pscustomobject]@{
                Group           = $group.Name
                Member          = $_.Name
                PrincipalSource = $_.PrincipalSource
                SID             = "$($_.SID)"
            }
        }
}

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

The Windows device you want to check, in 64-bit Windows PowerShell 5.1 (the LocalAccounts module isn't available in 32-bit PowerShell on a 64-bit system).

Reading the output

• Finds each group by its well-known SID, so it works whatever the groups are called in the device's language. Groups that don't exist on the device (for example Hyper-V Administrators without Hyper-V) are skipped.
• PrincipalSource says where each member comes from: Local, Active Directory, Microsoft Entra group or Microsoft Account.
• Domain and Entra groups are listed as groups, not expanded into their members.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.