How do service and Console login accounts interact?

There are two passwords in play here:

1. The password that the services use (ie the PA Server Monitor service on the Master, and the PA Server Monitor Satellite services). These can be controlled/changed via services.msc or via the Settings dialog. These are always Windows accounts since Windows is the one that will do the login and then start the service. It's possible for a login to happen and the password to change after, and the service will keep running happily (until it is restarted, at which time the login needs to happen again). Standard Windows service stuff.

2. The Console passwords are different. They can be AD accounts, or they could be from UserList.txt (see Settings -> Remote Access). The Console itself is just being authenticated in this case -- nothing actually gets run with these accounts. One other clarification, when you start the Console on a Satellite computer, it's just logging in back to the Master exactly the same as if you started the Console on your desktop -- the Console doesn't even know the Satellite happens to be running on the same system.