Cisco :: Upgraded Configuration Of About 650 Devices

I have upgraded the configuration of about 650 Cisco devices (catalyst switches, routers, ASA, VGxxx, etc.) so as to integrate a new AAA server (Cisco ACS 5.3). This AAA server is bound with an Active Directory Server (MS Windows Server 2008 R2) for user authentication (only for admin purpose not for network access).Before this upgrade, the AAA server was Cisco ACS 4.1 (not bound to the Active Directory Server). Cisco devices are managed with a Cisco LMS 4.01 server. I modified the Network Level Login Credentials of the full privileged user of LMS because any caracters of the password were not accepted by AD. Therefore, in order to maintain the telnet connection availibility beetween the LMS server and the network devices, I had also to upgrade the appropriate device credentials in DCR. Finally I got the following issue when performing the credential verification : telnet incorrect !
 
When performing direct telnet connection with TeraTerm, I can reach the device and the user authentication is well performed by the ACS server and the AD server. Log files on the ACS 5.3 server show the accepted connection, the initiator and the tarjet device.But when LMS sends a telnet connection on to the same device (through a credential verification job), the ACS 5.3 does not receive the authentication inquiry (nothing in the tacacs+ log file). When performing AAA authentication debugging on the switch, the bind message repeats many times with no following authorization message (as requested also in debug). [code]
 
I reversed to the initial configuration of the switch (with ACS 4.1 as AAA server, not bound to AD) and performed a test with the same LMS server (with reversed credential data). The credential verification job is successful and the debug mode of AAA shows a correct negotiation beetween the switch and its ACS server : [code]

Indeed the ACS 4.1 authentication log file lists the successfull connection of the LMS server to the switch.In the two cases I exported the device credentials to a csv file to check the availability of each.
 
So, how to explain why a telnet session initiated by a terminal, can connect in both cases (ACS 4.1 ans ACS 5.3) to the switch and a telnet session coming from a LMS job can only connect to the ACS 4.1 server? When the switch "sees" an incoming telnet session request from everywhere, it must send it to the AAA server specified for authentication. I do not anderstand why the request from LMS is not sent to ACS (no record in log file, even according authentication deny.