The Active Directory plugin is adding a admin username as the Bind DN when the user add a new user in Global Security. The following tag gets added to the config file:

<bindName> [USER_NT_USERName] </bindName>

This prevents anyone from logging into Jenkins. By removing that entry from the config, users are able to log into Jenkins