Auto Publish – main to live - 2026-03-24 22:00 UTC

reference/5.1/Microsoft.PowerShell.Core/About/about_Arrays.md

@@ -1,7 +1,7 @@
 ---
 description: Describes arrays, which are data structures designed to store collections of items.
 Locale: en-US
-ms.date: 01/18/2026
+ms.date: 03/24/2026
 no-loc: [Count, Length, LongLength, Rank, ForEach, Clear, Default, First, Last, SkipUntil, Until, Split, Tuple]
 online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_arrays?view=powershell-5.1&WT.mc_id=ps-gethelp
 schema: 2.0.0
@@ -583,12 +583,67 @@ every item in the collection.
 Wednesday, June 20, 2018 9:21:57 AM
 ```
 
+> [!NOTE]
+> The `ForEach()` method wraps properties into a collection before enumeration.
+> Using `ForEach()` normally returns all items in both array. However, if you
+> want to access elements of the wrapped collection, you need to use two
+> indices.
+
+Consider the following example where the object `$myObject` has a property with
+single value and a property containing an array of 11 integers.
+
+```powershell
+$myObject = [pscustomobject]@{
+    singleValue = 'Hello'
+    arrayValue  = @(0..10)
+}
+```
+
+When you use the `ForEach()` method to access a property of the object, the
+property is wrapped in a collection.
+
+```powershell
+PS> $myObject.ForEach('singleValue').GetType().Name
+Collection`1
+PS> $myObject.ForEach('singleValue')[0].GetType().Name
+String
+PS> $myObject.ForEach('singleValue') # Enumerate the collection object
+Hello
+```
+
+To access the an element of the array, you need to use two indices.
+
+```powershell
+PS> $myObject.ForEach('arrayValue').GetType().Name
+Collection`1
+# A single Collection item
+PS> $myObject.ForEach('arrayValue').Count
+1
+# First item in the collection is an array of 11 items
+PS> $myObject.ForEach('Value')[0].Count
+11
+# Access the first item in the array of 11 items
+PS> $myObject.ForEach('Value')[0][0]
+0
+```
+
+This is different than using the `ForEach()` method using with a scriptblock to
+access the **Value** property of each object.
+
+```powershell
+PS> $myObject.ForEach({$_.Value}).Count    # An array of 11 items
+11
+```
+
+Use the scriptblock syntax to avoid the wrapping behavior when you want to
+access complex property types, such as arrays or nested objects.
+
 #### ForEach(string methodName)
 
 #### ForEach(string methodName, object[] arguments)
 
-Lastly, `ForEach()` methods can be used to execute a method on every item in
-the collection.
+You can use the `ForEach()` method to execute an object's method on every item
+in the collection.
 
 ```powershell
 ("one", "two", "three").ForEach("ToUpper")

reference/5.1/Microsoft.PowerShell.Core/About/about_Operators.md

@@ -1,7 +1,7 @@
 ---
 description: Describes the operators that are supported by PowerShell.
 Locale: en-US
-ms.date: 01/18/2026
+ms.date: 03/24/2026
 online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_operators?view=powershell-5.1&WT.mc_id=ps-gethelp
 schema: 2.0.0
 title: about_Operators
@@ -301,7 +301,7 @@ At line:1 char:2
     + FullyQualifiedErrorId : CommandNotFoundException
 ```
 
-The [Invoke-Expression][26] cmdlet can execute code that causes parsing errors
+The [Invoke-Expression][27] cmdlet can execute code that causes parsing errors
 when using the call operator.
 
 ```powershell
@@ -343,6 +343,11 @@ Hello World!
 
 For more about scriptblocks, see [about_Script_Blocks][21].
 
+> [!IMPORTANT]
+> Using this operator with untrusted data is a security risk. Only use trusted
+> data with this operator. For more information, see
+> [Validate All Inputs][26].
+
 ### Cast operator `[ ]`
 
 Converts or limits objects to the specified type. If the objects can't be
@@ -644,4 +649,5 @@ properties and methods of an object, use the Static parameter of the
 [22]: about_Split.md
 [23]: about_Type_Operators.md
 [24]: about_Variables.md
-[26]: xref:Microsoft.PowerShell.Utility.Invoke-Expression
+[26]: https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/
+[27]: xref:Microsoft.PowerShell.Utility.Invoke-Expression

reference/5.1/Microsoft.PowerShell.Core/Invoke-Command.md

@@ -2,7 +2,7 @@
 external help file: System.Management.Automation.dll-Help.xml
 Locale: en-US
 Module Name: Microsoft.PowerShell.Core
-ms.date: 01/18/2026
+ms.date: 03/24/2026
 online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-5.1&WT.mc_id=ps-gethelp
 schema: 2.0.0
 aliases:
@@ -706,6 +706,11 @@ passed by position from the array value supplied to **ArgumentList**. This is kn
 splatting. For more information about the behavior of **ArgumentList**, see
 [about_Splatting](about/about_Splatting.md#splatting-with-arrays).
 
+> [!IMPORTANT]
+> Using this parameter with untrusted data is a security risk. Only use trusted data with this
+> parameter. For more information, see
+> [Validate All Inputs](https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/).
+
 ```yaml
 Type: System.Object[]
 Parameter Sets: (All)
@@ -1002,6 +1007,11 @@ the values of parameters in the script.
 When you use this parameter, PowerShell converts the contents of the specified script file to a
 scriptblock, transmits the scriptblock to the remote computer, and runs it on the remote computer.
 
+> [!IMPORTANT]
+> Using this parameter with untrusted data is a security risk. Only use trusted data with this
+> parameter. For more information, see
+> [Validate All Inputs](https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/).
+
 ```yaml
 Type: System.String
 Parameter Sets: FilePathRunspace, FilePathComputerName, FilePathUri, FilePathVMId, FilePathVMName, FilePathContainerId

reference/5.1/Microsoft.PowerShell.Management/Invoke-Item.md

@@ -2,7 +2,7 @@
 external help file: Microsoft.PowerShell.Commands.Management.dll-Help.xml
 Locale: en-US
 Module Name: Microsoft.PowerShell.Management
-ms.date: 12/12/2022
+ms.date: 03/11/2026
 online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.management/invoke-item?view=powershell-5.1&WT.mc_id=ps-gethelp
 schema: 2.0.0
 aliases:
@@ -151,6 +151,11 @@ as escape sequences.
 
 For more information, see [about_Quoting_Rules](../Microsoft.Powershell.Core/About/about_Quoting_Rules.md).
 
+> [!IMPORTANT]
+> Using this parameter with untrusted data is a security risk. Only use trusted data with this
+> parameter. For more information, see
+> [Validate All Inputs](https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/).
+
 ```yaml
 Type: System.String[]
 Parameter Sets: LiteralPath
@@ -166,7 +171,11 @@ Accept wildcard characters: False
 ### -Path
 
 Specifies the path to the selected item.
-Wildcard characters are permitted.
+
+> [!IMPORTANT]
+> Using this parameter with untrusted data is a security risk. Only use trusted data with this
+> parameter. For more information, see
+> [Validate All Inputs](https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/).
 
 ```yaml
 Type: System.String[]
@@ -236,7 +245,7 @@ Accept wildcard characters: False
 This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
 -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose,
 -WarningAction, and -WarningVariable. For more information, see
-[about_CommonParameters](../Microsoft.PowerShell.Core/About/about_CommonParameters.md).
+[about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
 
 ## INPUTS
 

reference/5.1/Microsoft.PowerShell.Management/Show-EventLog.md

@@ -24,12 +24,8 @@ Show-EventLog [[-ComputerName] <String>] [<CommonParameters>]
 The `Show-EventLog` cmdlet opens Event Viewer on the local computer and displays in it all of the
 classic event logs on the local computer or a remote computer.
 
-To open Event Viewer on Windows Vista and later versions of the Windows operating system, the
-current user must be a member of the Administrators group on the local computer.
-
-The cmdlets that contain the **EventLog** noun (the **EventLog** cmdlets) work only on classic event
-logs. To get events from logs that use the Windows Event Log technology in Windows Vista and later
-versions of the Windows operating system, use the `Get-WinEvent` cmdlet.
+The cmdlets that contain the **EventLog** noun work only on classic event logs. To get events from
+logs that use the Windows Event Log technology, use the `Get-WinEvent` cmdlet.
 
 ## EXAMPLES
 
@@ -54,12 +50,13 @@ This command opens Event Viewer and displays in it the classic event logs on the
 ### -ComputerName
 
 Specifies a remote computer. `Show-EventLog` displays the event logs from the specified computer in
-Event Viewer on the local computer. The default is the local computer.
-
-Type the NetBIOS name, an IP address, or a fully qualified domain name of a remote computer.
+Event Viewer on the local computer. The default is the local computer. When you use this parameter,
+the command runs `eventvwr.exe` and passes the value of this parameter.
 
-This parameter does not rely on Windows PowerShell remoting. You can use the **ComputerName**
-parameter even if your computer is not configured to run remote commands.
+> [!IMPORTANT]
+> Using this parameter with untrusted data is a security risk. Only use trusted data with this
+> parameter. For more information, see
+> [Validate All Inputs](https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/).
 
 ```yaml
 Type: System.String
@@ -77,26 +74,27 @@ Accept wildcard characters: False
 
 This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
 -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose,
--WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
+-WarningAction, and -WarningVariable. For more information, see
+[about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
 
 ## INPUTS
 
 ### None
 
-You cannot pipe input to this cmdlet.
+You can't pipe input to this cmdlet.
 
 ## OUTPUTS
 
 ### None
 
-This cmdlet does not generate any output.
+This cmdlet doesn't generate any output.
 
 ## NOTES
 
 - The Windows PowerShell command prompt returns as soon as Event Viewer opens. You can work in the
   current session while Event Viewer is open.
 
-  Because this cmdlet requires a user interface, it does not work on Server Core installations of
+  Because this cmdlet requires a user interface, it doesn't work on Server Core installations of
   Windows Server.
 
 ## RELATED LINKS

reference/5.1/Microsoft.PowerShell.Management/Start-Process.md

@@ -2,7 +2,7 @@
 external help file: Microsoft.PowerShell.Commands.Management.dll-Help.xml
 Locale: en-US
 Module Name: Microsoft.PowerShell.Management
-ms.date: 11/01/2023
+ms.date: 03/11/2026
 online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.management/start-process?view=powershell-5.1&WT.mc_id=ps-gethelp
 schema: 2.0.0
 aliases:
@@ -203,6 +203,11 @@ program on the computer. This parameter is required.
 
 If you specify only a filename, use the **WorkingDirectory** parameter to specify the path.
 
+> [!IMPORTANT]
+> Using this parameter with untrusted data is a security risk. Only use trusted data with this
+> parameter. For more information, see
+> [Validate All Inputs](https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/).
+
 ```yaml
 Type: System.String
 Parameter Sets: (All)
@@ -418,6 +423,11 @@ Specifies the location that the new process should start in. The default is the
 executable file or document being started. Wildcards aren't supported. The path must not contain
 characters that would be interpreted as wildcards.
 
+> [!IMPORTANT]
+> Using this parameter with untrusted data is a security risk. Only use trusted data with this
+> parameter. For more information, see
+> [Validate All Inputs](https://top10proactive.owasp.org/archive/2024/the-top-10/c3-validate-input-and-handle-exceptions/).
+
 ```yaml
 Type: System.String
 Parameter Sets: (All)

reference/7.4/Microsoft.PowerShell.Core/About/about_Arrays.md

@@ -1,9 +1,9 @@
 ---
 description: Describes arrays, which are data structures designed to store collections of items.
 Locale: en-US
-ms.date: 01/18/2026
+ms.date: 03/24/2026
 no-loc: [Count, Length, LongLength, Rank, ForEach, Clear, Default, First, Last, SkipUntil, Until, Split, Tuple]
-online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_arrays?view=powershell-5.1&WT.mc_id=ps-gethelp
+online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_arrays?view=powershell-7.4&WT.mc_id=ps-gethelp
 schema: 2.0.0
 title: about_Arrays
 ---
@@ -583,12 +583,67 @@ every item in the collection.
 Wednesday, June 20, 2018 9:21:57 AM
 ```
 
+> [!NOTE]
+> The `ForEach()` method wraps properties into a collection before enumeration.
+> Using `ForEach()` normally returns all items in both array. However, if you
+> want to access elements of the wrapped collection, you need to use two
+> indices.
+
+Consider the following example where the object `$myObject` has a property with
+single value and a property containing an array of 11 integers.
+
+```powershell
+$myObject = [pscustomobject]@{
+    singleValue = 'Hello'
+    arrayValue  = @(0..10)
+}
+```
+
+When you use the `ForEach()` method to access a property of the object, the
+property is wrapped in a collection.
+
+```powershell
+PS> $myObject.ForEach('singleValue').GetType().Name
+Collection`1
+PS> $myObject.ForEach('singleValue')[0].GetType().Name
+String
+PS> $myObject.ForEach('singleValue') # Enumerate the collection object
+Hello
+```
+
+To access the an element of the array, you need to use two indices.
+
+```powershell
+PS> $myObject.ForEach('arrayValue').GetType().Name
+Collection`1
+# A single Collection item
+PS> $myObject.ForEach('arrayValue').Count
+1
+# First item in the collection is an array of 11 items
+PS> $myObject.ForEach('Value')[0].Count
+11
+# Access the first item in the array of 11 items
+PS> $myObject.ForEach('Value')[0][0]
+0
+```
+
+This is different than using the `ForEach()` method using with a scriptblock to
+access the **Value** property of each object.
+
+```powershell
+PS> $myObject.ForEach({$_.Value}).Count    # An array of 11 items
+11
+```
+
+Use the scriptblock syntax to avoid the wrapping behavior when you want to
+access complex property types, such as arrays or nested objects.
+
 #### ForEach(string methodName)
 
 #### ForEach(string methodName, object[] arguments)
 
-Lastly, `ForEach()` methods can be used to execute a method on every item in
-the collection.
+You can use the `ForEach()` method to execute an object's method on every item
+in the collection.
 
 ```powershell
 ("one", "two", "three").ForEach("ToUpper")
@@ -1124,5 +1179,3 @@ LastWriteTimeUtc  Property   datetime LastWriteTimeUtc {get;set;}
 [13]: about_While.md
 [14]: https://wikipedia.org/wiki/Row-_and_column-major_order
 
-
-