After compromising a standard domain user's workstation during an internal engagement, you have an unprivileged shell and want to identify which accounts belong to the Domain Admins group so you can prioritize lateral movement targets. You want to use only built-in Windows tooling to avoid dropping additional binaries. Which command returns the membership of the Domain Admins group by querying the domain controller?