I figured it out. Turns out this is easy. Local admins on the server have sysadmin rights from sqlcmd when the database is in single-user mode. I...