ForEach-Object

Performs an operation against each item in a collection of input objects. PowerShell reference

From the PowerShell reference 9 parameters Aliases %, foreach

What it does

from the PowerShell reference, CC BY 4.0

Performs an operation against each item in a collection of input objects. The ForEach-Object cmdlet performs an operation on each item in a collection of input objects. The input objects can be piped to the cmdlet or specified using the InputObject parameter. Starting in Windows PowerShell 3.0, there are two different ways to construct a ForEach-Object command. - Scriptblock syntax. You can use a scriptblock to specify the operation. Within the scriptblock, use the $_ variable to represent the current object. The scriptblock is the value of the Process parameter. The scriptblock can contain any PowerShell script. For example, the following command gets the value of the ProcessName property of each process on the computer. Get-Process | ForEach-Object {$_.ProcessName} ForEach-Object supports the begin, process, and end blocks as described in about_Functions. NOTE: > The scriptblocks run in the caller's scope. Therefore, the blocks have access to variables in > that scope and can create new variables that persist in that scope after the cmdlet completes. - Simplified syntax. Using the simplified syntax, you specify a property or method name of the object in the pipeline. ForEach-Object returns the value of the property or method for each object in the pipeline. For example, the following command also gets the value of the ProcessName property of each process on the computer. Get-Process | ForEach-Object ProcessName The simplified syntax was introduced in Windows PowerShell 3.0. For more information, see about_Simplified_Syntax.

ForEach-Object [-InputObject <PSObject>] [-Begin <ScriptBlock>] [-Process] <ScriptBlock[]> [-End <ScriptBlock>] [-RemainingScripts <ScriptBlock[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

ForEach-Object [-InputObject <PSObject>] [-MemberName] <String> [-ArgumentList <Object[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

Divide integers in an array

30000, 56798, 12432 | ForEach-Object -Process {$_/1024}Identify

Get the length of all the files in a directory

Get-ChildItem $PSHOME | ForEach-Object -Process {
if (!$_.PSIsContainer) {$_.Name; $_.Length / 1024; " " }
}

Identify

Operate on the most recent System events

Get-EventLog -LogName System -Newest 1000 |
ForEach-Object -Begin {Get-Date} -Process {
Out-File -FilePath Events.txt -Append -InputObject $_.Message
} -End {Get-Date}

Identify

Trips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Change the value of a Registry key

Get-ItemProperty -Path HKCU:\Network\* |
ForEach-Object {
Set-ItemProperty -Path $_.PSPath -Name RemotePath -Value $_.RemotePath.ToUpper()
}

Identify

Use the $null automatic variable

1, 2, $null, 4 | ForEach-Object {"Hello"}Identify

Get property values

Get-Module -ListAvailable | ForEach-Object -MemberName Path
Get-Module -ListAvailable | foreach Path

Identify

Split module names into component names

"Microsoft.PowerShell.Core", "Microsoft.PowerShell.Host" |
ForEach-Object {$_.Split(".")}
"Microsoft.PowerShell.Core", "Microsoft.PowerShell.Host" |
ForEach-Object -MemberName Split -ArgumentList "."
"Microsoft.PowerShell.Core", "Microsoft.PowerShell.Host" |
foreach Split "."

Identify

Using ForEach-Object with two scriptblocks

1..2 | ForEach-Object { 'begin' } { 'process' }Identify

Using ForEach-Object with more than two scriptblocks

1..2 | ForEach-Object { 'begin' } { 'process A' } { 'process B' } { 'end' }Identify

Run multiple scriptblocks for each pipeline item

1..2 | ForEach-Object -Begin $null -Process { 'one' }, { 'two' }, { 'three' } -End $nullIdentify

Its page in the reference: ForEach-Object.

Parameters

9 in the PowerShell reference

-ArgumentListSpecifies an array of arguments to a method call. For more information about the behavior of ArgumentList, see about_Splatting. This parameter was introduced in Windows PowerShell 3.0.

-BeginSpecifies a scriptblock that runs before this cmdlet processes any input objects. This scriptblock is only run once for the entire pipeline. For more information about the begin block, see about_Functions.

-EndSpecifies a scriptblock that runs after this cmdlet processes all input objects. This scriptblock is only run once for the entire pipeline. For more information about the end block, see about_Functions.

-InputObjectSpecifies the input objects. ForEach-Object runs the scriptblock or operation statement on each input object. Enter a variable that contains the objects, or type a command or expression that gets the objects. When you use the InputObject parameter with ForEach-Object, instead of piping command results to ForEach-Object, the InputObject value is treated as a single object. This is true even if the value is a collection that's the result of a command, such as -InputObject (Get-Process). Because InputObject can't return individual properties from an array or collection of objects, we recommend that if you use ForEach-Object to perform operations on a collection of objects for those objects that have specific values in defined properties, you use ForEach-Object in the pipeline, as shown in the examples in this topic.

-MemberNameSpecifies the name of the member property to get or the member method to call. The members must be instance members, not static members. Wildcard characters are permitted, but work only if the resulting string resolves to a unique value. For example, if you run Get-Process | foreach -MemberName *Name, the wildcard pattern matches more than one member causing the command to fail. This parameter was introduced in Windows PowerShell 3.0.

-ProcessSpecifies the operation that's performed on each input object. This scriptblock is run for every object in the pipeline. For more information about the process block, see about_Functions. When you provide multiple scriptblocks to the Process parameter, the first scriptblock is always mapped to the begin block. If there are only two scriptblocks, the second block is mapped to the process block. If there are three or more scriptblocks, first scriptblock is always mapped to the begin block, the last block is mapped to the end block, and the middle blocks are mapped to the process block.

-RemainingScriptsSpecifies all scriptblocks that aren't taken by the Process parameter. This parameter was introduced in Windows PowerShell 3.0.

-ConfirmPrompts you for confirmation before running the cmdlet.

-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.

ForEach-Object

What it does

Parameters

See also