Kind of hard to answer that as you haven't shared how you know what you know or how you have it configured. Hopefully a few general comments will help:
1) The normal process of authentication lookup in ACS is to first look in the local ACS DB
2) If there is no matching user, then it will check to see what the "unknown user policy" is.
3) If the unknown user policy does not allow external db checking, and there is no user in the local ACS db, then the user will fail authen.
4) If the unknown user policy does allow external db checking, then it will check each one of those in the configured order.
From your comments, it does sound like you have an unknown user policy configured to check external DB's, and the Windows SAM or AD, in particular.
Typically, the reason it would try to go to the external DB lookup is because your submitted name doesn't match a name in the local ACS db that you expect it to match - for example, because you are automatically appending or stripping a realm (mycompany/testuser is submitted when you expect "testuser" to be submitted).
One way to check this is to look at the failed authentication logs (which you're probably already doing). However, also compare this information to the detailed logs. Those logs are availabe under Program Files>>Cisco Secure ACS 3.0>>CSAuth>>Logs>>CSAuth. There are similar files for CSRadius that may be helpful. A careful analysis and comparison of these logs and your failed attempts log should isolate the source of the problem.
HTH
Jeff
