Checking Windows Disk Encryption with Pester

Question

I am trying to test the Protection Status of local disks on Windows Server with Pester using the following Pester code:

Describe 'Encryption Check' {    
$Diskencr =  Get-BitLockerVolume

$Diskencr.ForEach{
    write-host $_.ProtectionStatus
    Context "Testing encryption on $($_)" {
        It "Encryption Enabled?" {$_.ProtectionStatus -match 'On' | Should -Be $True}
    }
}

}

The output shows 3 disks have "Protection Status" On and 1 is Off.

But the Pester "It check" says all are false and I do not know why?

    Starting discovery in 1 files.
Discovering in D:\Temp\test.ps1.
On
Off
On
On
Found 4 tests. 2.44s
Discovery finished in 2.44s.

Running tests from 'D:\Temp\test.ps1'
Describing Encryption Check
 Context Testing encryption on E:
   [-] Encryption Enabled? 15ms (14ms|1ms)
    Expected $true, but got $false.
    at It "Encryption Enabled?" {$_.ProtectionStatus -match 'On' | Should -Be $True}, D:\Temp\test.ps1:7
    at <ScriptBlock>, D:\Temp\test.ps1:7
 Context Testing encryption on \\?\Volume{070ba12e-0000-0000-0000-100000000000}\
   [-] Encryption Enabled? 5ms (4ms|1ms)
    Expected $true, but got $false.
    at It "Encryption Enabled?" {$_.ProtectionStatus -match 'On' | Should -Be $True}, D:\Temp\test.ps1:7
    at <ScriptBlock>, D:\Temp\test.ps1:7
 Context Testing encryption on D:
   [-] Encryption Enabled? 8ms (6ms|2ms)
    Expected $true, but got $false.
    at It "Encryption Enabled?" {$_.ProtectionStatus -match 'On' | Should -Be $True}, D:\Temp\test.ps1:7
    at <ScriptBlock>, D:\Temp\test.ps1:7
 Context Testing encryption on C:
   [-] Encryption Enabled? 5ms (4ms|1ms)
    Expected $true, but got $false.
    at It "Encryption Enabled?" {$_.ProtectionStatus -match 'On' | Should -Be $True}, D:\Temp\test.ps1:7
    at <ScriptBlock>, D:\Temp\test.ps1:7
Tests completed in 2.72s
Tests Passed: 0, Failed: 4, Skipped: 0 NotRun: 0

Answer 1

The It block isn't allowing scope to bleed into it. It has to be reorganized into something like this, with the -TestCases argument

Describe 'Encryption Check' {
    Context "Testing encryption on drives" {
        It "checking a drive" -TestCases @(
            $Diskencr =  Get-BitLockerVolume
            $Diskencr.ForEach{
                @{ DriveLetter = $_ }
            }
        ) { 
            param($DriveLetter) 
                Write-Host $DriveLetter 
                $DriveLetter.ProtectionStatus -match 'On' | Should -BeExactly $True
        } 
    } 
}