you would need to change the actions on "Protected Content" to replace item with an alert and quarantine (default is allow through) and then it should start blocking the pdf files. if you want to test first to make sure it works then set the action to allow through and log. this will still allow the file through but will put an entry in detected items.
I've tried what you wrote, but it doesn't work, I'm afraid.
What else have I been trying to do?
- "Password protected files" - working with zip, 7zip etc, but not with pdf - "Protected content" - not working with password protected PDF (created with Acrobat) - "Encrypted content" - not working with password protected PDF (created with Acrobat)