This is a new single-server-farm install of SharePoint 2016 on Win 2012 R2. All seems OK except that People Picker is not finding any users. This should be a vanilla single-domain AD scenario.
I've configured AD profile synchronisation in the User Profile Service Application, and this appears to be working OK (if I go into 'Manage User Profiles' I can pull up details of the users) and I can see a count of the User Profiles.
The domain administrator account (which was used to carry out all install/config steps) can log into and browse the site collection I created, but is unable to add any other users into the site groups, because people picker isn't finding anyone else.
I have not used stsadm to modify any People Picker properties.
The site is configured to use Claims Based NTLM auth.
I'm new to SharePoint, so I suspect I'm missed a step somewhere along the way, but a day of reading has not uncovered the culprit. Do I have to somehow convert the imported profiles into actual users? Do I have to do further config to People Picker to allow it see the users? Might it be something to do with the permissions of the account the site collection is running under?