Powershell管道就像流水线，对于数据的处理是一个环节接着一个环节，如果你想在某一环节对流进来的数据逐个细致化的处理，可是使用ForEach-Object，$_ 代表当前的数据。
对管道对象逐个处理
如果使用Get-WmiObject 获取系统中的服务，为了排版可能会也会使用Format-Table对结果进行表格排版。
PS C:Powershell> Get-WmiObject Win32_Service | Format-Table status,DisplayName
-AutoSize
status DisplayName
------ -----------
OK Adobe Acrobat Update Service
OK Application Experience
OK Application Layer Gateway Service
OK Application Host Helper Service
OK Application Identity
OK Application Information
OK Application Management
OK ASP.NET State Service
但是如果想对每个服务进行更定制化的处理可是使用ForEach-Object
PS C:Powershell> Get-WmiObject Win32_Service | ForEach-Object {"Name:"+ $_.Disp
layName, ", Is ProcessId more than 100:" + ($_.ProcessId -gt 100)}
Name:Adobe Acrobat Update Service , Is ProcessId more than 100:True
Name:Application Experience , Is ProcessId more than 100:False
Name:Application Layer Gateway Service , Is ProcessId more than 100:False
Name:Application Host Helper Service , Is ProcessId more than 100:True
Name:Application Identity , Is ProcessId more than 100:True
Name:Application Information , Is ProcessId more than 100:True
Name:Application Management , Is ProcessId more than 100:False
Name:ASP.NET State Service , Is ProcessId more than 100:False
结合条件处理
ForEach-Object的处理可以包含任意Powershell脚本，当然也包括条件语句
1
2
3
4
Get-WmiObject Win32_Service | ForEach-Object {
if ($_.ProcessId -gt 3000)
{ "{0}({1})" -f $_.DisplayName,$_.ProcessID}
}
Windows Presentation Foundation Font Cache 3.0.0.0(5408)
Microsoft Network Inspection(5260)
BranchCache(4112)
Windows Modules Installer(7656)
调用方法
在ForEach-Object中，$_代表当前对象，当然也允许通过$_,调用该对象支持的方法。
下面的例子杀死所有IE浏览器进程：
PS C:Powershell> Get-Process iexplore
Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
------- ------ ----- ----- ----- ------ -- -----------
883 29 14728 22432 181 34.26 4300 iexplore
771 28 55552 129152 425 8.56 5732 iexplore
1216 51 104324 143916 539 572.41 5912 iexplore
801 25 49200 25372 285 5.99 6252 iexplore
691 25 57564 95796 333 8.08 6388 iexplore
1256 38 85848 127012 379 20.37 7856 iexplore
PS C:Powershell> Get-Process iexplore | ForEach-Object {$_.kill()}
PS C:Powershell> Get-Process iexplore
Get-Process : 找不到名为“iexplore”的进程。请验证该进程名称，然后再次调用 cmdlet。
所在位置 行:1 字符: 12
+ Get-Process <<<< iexplore
+ CategoryInfo : ObjectNotFound: (iexplore:String) [Get-Process],
ProcessCommandException
+ FullyQualifiedErrorId : NoProcessFoundForGivenName,Microsoft.PowerShell.
Commands.GetProcessCommand