iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Real-time protection, firewall protection, and on-demand scans defend different parts of a Windows PC. Real-time protection watches files and activity as they are downloaded, opened, or run. A firewall evaluates network connections entering or leaving the device. An on-demand scan is a check you start yourself, covering one item, selected locations, common hiding places, or the whole device.
They complement one another rather than substitute for one another. Keep real-time protection and the firewall enabled, then use an on-demand scan when you want a point-in-time check or have a specific reason to investigate. The instructions below apply to Microsoft Windows Security and Microsoft Defender Antivirus on Windows 10 and Windows 11; menus can differ by release, organization policy, or the antivirus product currently active.
The three protections at a glance
| Protection | What it examines | When it acts | What you do |
|---|---|---|---|
| Real-time protection | Files and activity as items are downloaded, opened, or run | Continuously while enabled | Keep it enabled; review detections and settings when needed |
| Firewall protection | Network traffic and connection attempts, using rules for items such as IP addresses, ports, and application paths | As connections are evaluated | Choose the appropriate network profile and allow specific apps when necessary |
| On-demand scan | A file, folder, common malware locations, every file and program, or the Windows environment outside normal startup | Only when you start or schedule it | Choose a scan type and wait for its results |
The key distinction is the object being inspected. Antivirus protection examines potentially malicious content and behavior; a firewall controls communications. A scan is an explicit investigation rather than a permanently running monitor.
What real-time protection does
Windows Security’s real-time protection is the continuously operating antivirus layer. Microsoft describes it as scanning downloads and items when they are opened or run. If a file appears dangerous, Defender can block or quarantine it before you continue using it.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
What it covers
- New files arriving through downloads, removable media, or other file activity.
- Items you open, launch, or otherwise cause Windows to process.
- Activity that occurs during ordinary use, without waiting for a manually started scan.
Real-time protection reduces the window in which a newly encountered threat can act. It is not a guarantee that every threat will be detected, and it does not replace a deliberate scan when you have a specific concern.
Where to check the setting
Open Windows Security > Virus & threat protection > Manage settings. The Real-time protection toggle appears there when Microsoft Defender is the active antivirus provider.
Turning the setting off means files you open or download are not scanned during that period. Microsoft says Windows turns the setting back on automatically after a short time, but leaving the device without this layer exposes it to avoidable risk. If troubleshooting requires a temporary change, finish the task and verify that protection has returned.
What a firewall protects
Windows Firewall filters network traffic and blocks unauthorized access according to rules. A rule can consider the remote or local IP address, port, protocol, or application path. This is connection control, not a scan of the files already stored on your drive.
Network profiles matter
Windows uses domain, private, and public profiles. A private profile is intended for a trusted home or small-office network. A public profile is for places such as cafés, hotels, airports, or other networks where the other connected devices are unknown. Public networks generally warrant stricter inbound controls.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
On an organization-managed computer, an administrator can lock profile and rule settings. If a control is unavailable or keeps reverting, the device may be following organizational policy rather than malfunctioning.
When an application is blocked
If a legitimate application cannot connect, Microsoft advises allowing that specific app through the firewall instead of switching the firewall off. Disabling the firewall removes network filtering for the device; an app-specific rule changes only the connection that needs to work. Confirm that the program and network are trustworthy before creating an exception.
Recommended Free Tools
What an on-demand scan does
An on-demand scan runs when you request it (or when a schedule launches it). It gives you a point-in-time examination that can be narrower or broader than the ongoing real-time checks.
Quick scan
A quick scan checks locations where malware commonly hides. It is the practical first choice for an immediate check when you do not have a specific file or folder in mind.
Full scan
A full scan checks every file and program on the device. It can take substantially longer than a quick scan, particularly on a large or busy drive, so start it when you can leave the computer running.
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Custom scan
A custom scan limits the check to files or folders you select. Use it when you received a suspicious archive, downloaded a particular installer, or want to investigate a removable drive without scanning everything else.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesMicrosoft Defender Offline scan
An Offline scan restarts the computer and checks it without loading normal Windows. Running outside the usual environment can make it harder for persistent malware to hide or interfere with the scan. Save open work first, because the restart interrupts applications and you may not be able to defer it indefinitely.
How to scan a single file or folder
- Open File Explorer and locate the file or folder.
- Right-click it.
- Choose Scan with Microsoft Defender. On Windows 11, select Show more options first if the command is not visible in the compact menu.
- Review the result in Windows Security and follow any quarantine or removal prompt before opening the item.
This targeted method is useful for one suspicious download and does not imply that the rest of the device has been checked.
How to start a broader scan
Quick scan procedure
- Open Windows Security.
- Select Virus & threat protection.
- Choose Quick scan.
- Keep the window available to review the result and any recommended action.
Full, custom, or offline procedure
- Open Windows Security > Virus & threat protection.
- Select Scan options.
- Choose Full scan, Custom scan, or Microsoft Defender Offline scan.
- For a custom scan, select the files or folders to examine. For Offline scan, save work and accept the restart.
- Let the scan finish, then read the result rather than closing the window immediately.
| Situation | Best starting option | Trade-off |
|---|---|---|
| You want a fast general check | Quick scan | It focuses on common hiding places, not every file |
| You suspect one download or folder | Custom scan or File Explorer right-click scan | It does not establish that unrelated locations are clean |
| You want the broadest normal-Windows check | Full scan | It examines every file and program and may take a long time |
| Malware may be persistent or interfere with Windows | Microsoft Defender Offline | The PC restarts and normal Windows is unavailable during the check |
How the protections work together
Consider a downloaded installer. Real-time protection can inspect it as it arrives or when you open it. If the installer attempts a network connection, the firewall evaluates that connection against its rules. A custom or full scan can later provide an additional point-in-time check. None of these steps turns the others into a substitute: a firewall does not inspect stored files for malware, and a manual scan does not keep watching after it ends.
For everyday use, the sensible baseline is to leave real-time protection and the firewall enabled, use a network profile that matches the network’s trust level, and start an on-demand scan when a file, symptom, or security alert justifies one.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Check which antivirus provider is active
Installing another antivirus product can cause Microsoft Defender Antivirus to enter disabled mode automatically. To see which provider is protecting the device, open Windows Security > Virus & threat protection and select Manage providers.
Only one product should normally provide continuous antivirus monitoring. Microsoft warns that running two real-time antivirus products concurrently can affect performance or create errors. On-demand scanners are different: because they operate only when requested or scheduled, they can coexist without both continuously intercepting file activity.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and how to recover
Confusing a firewall alert with a virus detection
A blocked connection means the firewall rejected network traffic under its rules; it does not by itself prove that a file is infected. Investigate the application and destination, and create a narrow allow rule only when you trust both.
Turning off the firewall to make an app work
Use the firewall’s option to allow the specific application instead. Re-enable the firewall immediately if it was disabled during troubleshooting, then test the app again.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Assuming a quick scan proves the whole PC is clean
A quick scan concentrates on common malware locations. If concern remains, run a full scan or choose Offline scan when persistent interference is possible.
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Running an Offline scan without preparing
Save documents, close applications, and connect the computer to power if appropriate. The process restarts Windows, so unsaved work can be lost.
Trying to change a setting that policy controls
On a work or school computer, security settings may be locked or restored by management policy. Contact the administrator instead of repeatedly changing the same control.
Leaving real-time protection disabled
While it is off, newly opened or downloaded files are not scanned by that layer. Complete the reason for disabling it, then return to Manage settings and confirm the toggle is on.
Windows 10 and Windows 11 scope
The guidance described here comes from Microsoft Support material for Windows 10 and Windows 11. Labels and menu placement can vary by Windows release, device policy, and active antivirus provider. Microsoft states that Windows 10 support ended on October 14, 2025; do not treat a Windows 10 installation as continuing to receive standard security fixes after that date. The protection concepts remain distinct, but an unsupported operating system carries a separate maintenance risk that these controls do not remove.
A practical protection routine
- Confirm in Manage providers which product supplies continuous antivirus protection.
- Keep that provider’s real-time protection enabled.
- Keep Windows Firewall enabled and use the public profile on networks whose other devices you do not trust.
- Allow a specific application through the firewall when necessary instead of disabling the firewall.
- Right-click a single suspicious item for a targeted scan.
- Use Quick scan for an immediate general check, Full scan for broad coverage, Custom scan for selected locations, and Offline scan for persistent-threat concerns.
- Save work before an Offline scan and review the result when the scan completes.
The simplest mental model is: real-time protection watches what happens to files, the firewall controls who can communicate with the computer, and an on-demand scan checks chosen storage or the Windows environment when you ask it to. Keeping all three roles available gives Windows layered protection without treating any one control as a replacement for the others.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
