Can you give us details of exactly how you have this configured?
How are you having NCM log into the devices? SSH or Telnet?
How are you having it do the config request? Telnet/SSH or SNMP?
How are you having it transport the configs? SSH, TFTP or SCP?
I've found for me, SSH2 works best for all of the above, and if a device is on a profile that only allows it, it will usually succeed for me. Have had some success with Telnet, but it seems slightly picky about many things. SCP and TFTP I've never had that much luck with.
Are you using local credentials or managed by TACACS or Radius? If local, are you just using a simple password/enable password, or are you using local username/passwords? I've found what works best for me is to user usernames/passwords (ie: newaaa), for local users I'll usually define the privilege level with the user (ie: username admin privilege 15 secret XXXX).
If you can, post both your sanitized TACACS config and maybe a screenshot of your NCM setup for a node that is having problems...