After way too much time spent stumbling around, I've finally discovered the cause of my problem. In short, I was getting "Permission denied" for my non-administrator users because on a DC, the Users group does not have the "Allow logon locally" user right. When sshd tried to switch context from the sshd service's account to a non-privileged user, the operation failed because the user didn't have the logon locally permission.
To fix, I had to edit the Default Domain Controller Policy to give the Users group the Allow logon locally right. This can be found in Group Policy Management > (your domain) > Group Policy Objects. Right-click, Edit. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Open Allow logon locally and add the Users group (or, you may want to create a 'SSH users' group and add that instead).
After editing the policy, run
gpupdate in a command prompt to refresh the changes and you're good to go.