The pattern: [tt]'/:x:[0-4][0-9]\{0,2\}:/d; /:x:[0-9][0-9]\{0,1\}:/d; s/:.*$//g'[/tt]
The Explanation...
[tt];[/tt] = A semicolon separates multiple edits. There are three edits given.
1) [tt]/:x:[0-4][0-9]\{0,2\}:/d[/tt]
2) [tt]/:x:[0-9][0-9]\{0,1\}:/d[/tt]
3) [tt]s/:.*$//g[/tt]
[tt]/<pattern>/d[/tt] = If this <pattern> is found in the line, delete (don't display) the line.
[tt]:x:[/tt] = Most modern Unixes use a shadow file for the password, so this field is almost always an 'x'. This is just a hard coded shortcut to find the third field. Your way of coding to find each colon works. I was just being lazy.
[tt][0-4][0-9]\{0,2\}[/tt] = a leading digit of 0 through 4, followed by zero, one, or two numeric digits. So up to 499.
So this, '
[tt]/:x:[0-4][0-9]\{0,2\}:/d[/tt]' means to delete any lines with '[tt]:x:0:[/tt]' to '[tt]:x:499:[/tt]' in it. That's fine but it misses anything starting with a 5 though 9, such as '[tt]:x:5[/tt]' through '[tt]:x:9:[/tt]' and '[tt]:x:50:[/tt]' through '[tt]:x:99:[/tt]'. So this deletes those...
[tt]/:x:[0-9][0-9]\{0,1\}:/d[/tt]
Anything that hasn't been deleted at this point must have a UID over 499 and we just need the username, so just chop the first colon and everything after it.
[tt]s/:.*$//g[/tt]