Aha, found the answer to my own question. I wasn't trying hard enough to go down the TSCON.EXE path.

This seems to work:

tscon.exe RDP-Tcp#0 /dest:console
tscon.exe RDP-Tcp#1 /dest:console
tscon.exe RDP-Tcp#2 /dest:console
tscon.exe RDP-Tcp#3 /dest:console
tscon.exe 0 /dest:console
tscon.exe 1 /dest:console
tscon.exe 2 /dest:console
tscon.exe 3 /dest:console
tscon.exe 4 /dest:console

One of those later ones (the "3" usually) seems to be the active console session and if you're on the lock screen then poof the lock screen is gone.