Before going the undocumented route like flokra suggests, I would try NetUserEnum() or NetQueryDisplayInformation()
If you want to go into undocumented land, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
has a (incomplete) list of accounts (It’s missing special accounts like ASPNET, HelpAssistant and SUPPORT_xxxx) It also has the path to the profile folder, which is a lot safer than using %ALLUSERSPROFILE%\..\
but why use it when there is GetProfilesDirectory()