Is DNS resolution enabled on the server? If so, do the clients all have reverse DNS? Are all of your DNS servers working? Have you enabled debug logging for

Is DNS resolution enabled on the server? If so, do the clients all have reverse DNS? Are all of your DNS servers working? Have you enabled debug logging for a period of time? Is there a common pattern of the source IP's that have the delay? For what it's worth, you will get a bigger audience of windows server engineers on serverfault. [1] You could also point testssh.sh to your server to see if it finds anything odd. [2] [1] - https://serverfault.com/ https://serverfault.com/ [2] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh