How to disable / enable GUI user account at CLI (disable Local Database?)

[z0rk]

I am considering enabling two-factor-authentication for my primary admin account. As a failsafe I considered disabling the default 'root' admin account in hope to be able to enable it at the console CLI, if needed. Is that possible?

EDIT:
As a related question, I believe that the Local Database should be disabled, if 2fA is enabled, how do you prevent locking yourself out, if the TOPT server is unavailable?