'Group Members as Display Name' column showing <Not Set or No Read Permission> in a CCS Query

Products

• Control Compliance Suite Standards Server
• Control Compliance Suite
• Control Compliance Suite Standards Database

Issue/Introduction

When you run a CCS query for local group membership, and the query runs successfully without errors, but you view the results of the query the 'Group Members as Display Name' column shows '<Not Set or No Read Permission>' for some of the users or groups. 

Environment

Release: CCS 12.5.x and CCS 12.6.x

Resolution

The 'Group Members as Display Name' column will show '<Not Set or No Read Permission>' if the user or group does not have a Display Name populated, or is a Global Group that does not have the option for a display name.

An example from my lab is below.  I have created a couple of dummy users in my #####\Administrators group along with some default global groups.  

For comparison, the 'Group Members <LIST>' displays the user/groups correctly:
 

But the 'Group Members as Display name' has some <Not Set or No Read Permission> for some entries:

Looking at the Global Group #####\Domain Admins and the #####\Enterprise Admins user group, they do not have a display name available by default so that is why it is reporting <Not Set or No Read Permission>:

Whereas the #####/Administrator user has the option for a Display Name, but it is not populated so that is why CCS is reporting <Not Set or No Read Permission>:

It is the same for the users user_one and user_two; user_one has the Display Name populated and user_two does not, so CCS reports that user_two is <Not Set or No Read Permission>:

The ##### and ##### do have their Display Names populated by default, so their Display Names are reported by the query:

 

Another possibility is that it could be a permission issue with the user that CCS uses to perform the query.  If the query is reporting <Not Set or No Read Permission> for all entries, and you have verified that some of the users and/or groups do have the Display Name field populated, then the user that CCS is using to perform the query does not have sufficient rights to view the Display Name.  

NOTE: If the Display Name has recently been updated or populated for a user or group, and you run the query and CCS still reports <Not Set or No Read Permission>, you will have to wait until the Domain Cache is updated in CCS (default 72 hours) before CCS will report the updated changes in the display name when the query is run.