After some research, I got things working with this script, following instructions from here. I had to add my domain to People Picker's set of AD domains that it searches, complete with a domain user which can be used to search the domain.
Add-PSSnapin Microsoft.SharePoint.PowerShell #Add the SP snapin
$webApp = Get-SPWebApplication http://MyUrl/ # Main SP web app
# Optional: clear existing domains
# $webApp.PeoplePickerSettings.SearchActiveDirectoryDomains.Clear() # Optional: clear existing domains
# $webApp.Update()
# Set an encryption key to encrypt/decrypt pwd
$key = ConvertTo-SecureString "Password123" -AsPlainText -Force
[Microsoft.SharePoint.SPSecurity]::SetApplicationCredentialKey($key)
$userpwd = ConvertTo-SecureString "<DomainUserPassword>" -AsPlainText -Force
# Define AD search object to add to web app
$ADSearchObj = New-Object Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
$ADSearchObj.DomainName = "domain.com"
$ADSearchObj.ShortDomainName = "domain"
$ADSearchObj.IsForest = $false # True if forest
$ADSearchObj.LoginName = "DomainUser"
$ADSearchObj.SetPassword($userpwd)
# Add AD search object to the main SP web app
$webApp.PeoplePickerSettings.SearchActiveDirectoryDomains.Add($ADSearchObj)
$webApp.Update()
I also had to add the same $ADSearchObj
to the SP Central Admin web app.
(thanks to @WaqasSarwarMCSE for pointing me in the right direction)