Certificate signing and excryption - some changes still allowed...

Question

I am trying to batch certify and encrypt PDFs.  The PDF should only allow the user to print the document; however, after the JS runs the user can still extract pages and copy content; all other permissions are behaving as expected.  Is another property missing that will trigger these misbehaviours to operate properly?
Also how does one use and read the cLegalAttest property?  I have specificed this property, but I can not find the string in the signature panel.
Thank you for your help!
var certPath = "/C/Documents and Settings/rrh/Desktop/Sample/";
var curDoc = this;
var proCertPW = curDoc.info.cliId
var proCertSig = curDoc.info.cliId + ".pfx";
var proCertFile = curDoc.info.cliId + ".cer";
var cliCertFile = curDoc.info.cliId + ".cer";
var solCert = security.importFromFile({cType:"Certificate", cDIPath:certPath + proCertFile});
var cliCert = security.importFromFile({cType:"Certificate", cDIPath:certPath + cliCertFile});
var oEntity = [{certificates:cliCert, defaultEncryptCert:proCert}];
curDoc.encryptForRecipients(
    oGroups:
            userEntities: oEntity,
            permissions:
                allowAll: false,
                allowAccessibility: false,
                allowContentExtraction: false,
                allowChanges: "none",
                allowPrinting: "lowQuality"
    bMetaData:true
// Certify the Document without visible signature
var f = curDoc.addField({cName:"CertifyDocument", cFieldType:"signature", nPageNum:0, oCoords:[0,0,0,0]});
f.display = display.hidden;
var s = {name: "My Company",
         location: "Monte Carlo, Monaco",
         reason: "I created this document specfically for " + curDoc.info.ClientName,
         contactInfo: "[email protected]",
         password: proCertPW,
         mdp: "allowNone" };
var sh = security.getHandler("Adobe.PPKLite");
sh.login(proCertPW, certPath + proCertSig);
sh.signInvisible = true;
sh.signAuthor = true;
f.signatureSign(
    oSig: sh,
    oInfo: s,
    bUI: false,
    cLegalAttest:"Do not distribute this document."
ppklite.logout();

Answer 1

Do you still have your LC environment setup?
No...   ran out of time. Where can I find 26-hour days?
To disable Copy Content and Page Extraction you need to set the MDP
(Modification Detection and Prevention) properties of you SignatureInfo
object appropritely and make sure you are using a certificate for
signing that is allowed to perform document certification and not
simply document approval.  Set your SignatureInfo.mdp value to
"allowNone".  This is the same as doing "Certify with Visible
Signature" from the "Sign & Certify" menu as opposed to simply
choosing "Sign Document", which will leave copy & extraction
allowed as well.  When the document is certified, copy & extraction
are disabled.
I verified my code, and as far as i can tell, MDP is set properly.  I also tested without the encryption, but content copying (both) and page extraction are still allowed.  I double checked the Digital ID (pfx) that I made with Microsoft Certificate Services (via server); it was only for code signing.  I created a "temporary" digital ID though Acrobat and it has permissions for <all>.  The tickmarks for encryption, signing, etc in security settings were also verified.
var strcDIPath = curDoc.path.replace(".pdf", "");
var f = curDoc.addField({cName:"CertifyDocument", cFieldType:"signature", nPageNum:0, oCoords:[0,0,0,0]});
f.display = display.hidden;
var sh = security.getHandler("Adobe.PPKLite");
sh.login(solCertPW, certPath + solCertSig);
sh.signInvisible = true;
sh.signAuthor = true;
var s = {name: "My Company",
         location: "Monte Carlo, Monaco",
         reason: "This document created specfically for " + curDoc.info.preparedFor + ".",
         contactInfo: "[email protected]",
         password: solCertPW,
         mdp: "allowNone"
f.signatureSign(
    oSig: sh,
    oInfo: s,
    cDIPath: strcDIPath + " (Certified).pdf",
    bUI: false,
    cLegalAttest: "Do not distribute this document."
sh.logout()
I was able to get the permissions needed by using P/W secuirty then certifying the document.
Ok, with cLegalAttest, this also has to do with an MDP certification.
When you apply an MDP signature to certify the document, it is scanned
for legal warnings.
I suppose I have no legal warnings in my document.  Maybe i could use this Godfather reference as a warning (it is work safe)?
http://www.foreignpolicy.com/images/090419_horse.jpg
Thank you for all your help and consideration.  I have been using "js_api_reference 8.pdf"; does Adobe have a resource other than this document for PDF security and code?  (I also have "acrobat_reader_security_9x.pdf")