Account SIDs–hopefully my last word
Ok the embarrassing moral of this story is that you shouldn't answer questions in a hurry at the end of the evening. 5 minutes after shutting down I realised that there is a far, far simpler way to get the info. Win32_AccountSID is a WMI linking class. It links Win32_SystemAccount and Win32_SID classes.
Get-WmiObject -Class Win32_SystemAccount | select Caption, Domain, Name, SID, LocalAccount
gets you all you need