diff --git a/domain-server/resources/describe-settings.json b/domain-server/resources/describe-settings.json
index 26a368fd04..43eb5c7ee9 100644
--- a/domain-server/resources/describe-settings.json
+++ b/domain-server/resources/describe-settings.json
@@ -99,14 +99,26 @@
         {
           "name": "standard_permissions",
           "type": "table",
-          "label": "Domain-Wide Permissions",
-          "help": "Standard Permissions:",
+          "label": "Domain-Wide User Permissions",
+          "help": "Indicate which users or groups can have which <a data-toggle='tooltip' data-html=true title='<p><strong>Connect</strong> &ndash; Sets whether a user can connect to the the domain.<br /><strong>Lock / Unlock</strong> &ndash; Sets whether a user change the &ldquo;locked&rdquo; property of an entity (either from on to off or off to on).<br /><strong>Rez</strong> &ndash; Sets whether a user can create new entities.<br /><strong>Rez Temporary</strong> &ndash; Sets whether a user can create new entities with a finite lifetime.<br /><strong>Write Assets</strong> &ndash; Sets whether a user can make changes to the domain&rsquo;s asset-server assets.<br /><strong>Ignore Max Capacity</strong> &ndash; Sets whether a user can connect even if the domain has reached or exceeded its maximum allowed agents.<br /></p><p>Note that permissions assigned to a specific user will supersede any parameter-level permissions that might otherwise apply to that user. Additionally, if more than one parameter is applicable to a given user, the permissions given to that user will be the sum of all applicable parameters. For example, let&rsquo;s say only localhost users can connect and only logged in users can lock and unlock entities. If a user is both logged in and on localhost then they will be able to both connect and lock/unlock entities.</p>'>domain-wide permissions</a>.",
+          "caption": "Standard Permissions",
           "can_add_new_rows": false,
 
+          "groups": [
+            {
+              "label": "User / Group",
+              "span": 1
+            },
+            {
+              "label": "Permissions <a data-toggle='tooltip' data-html='true' title='<p><strong>Connect</strong> &ndash; Sets whether a user can connect to the the domain.<br /><strong>Lock / Unlock</strong> &ndash; Sets whether a user change the &ldquo;locked&rdquo; property of an entity (either from on to off or off to on).<br /><strong>Rez</strong> &ndash; Sets whether a user can create new entities.<br /><strong>Rez Temporary</strong> &ndash; Sets whether a user can create new entities with a finite lifetime.<br /><strong>Write Assets</strong> &ndash; Sets whether a user can make changes to the domain&rsquo;s asset-server assets.<br /><strong>Ignore Max Capacity</strong> &ndash; Sets whether a user can connect even if the domain has reached or exceeded its maximum allowed agents.<br /></p><p>Note that permissions assigned to a specific user will supersede any parameter-level permissions that might otherwise apply to that user. Additionally, if more than one parameter is applicable to a given user, the permissions given to that user will be the sum of all applicable parameters. For example, let&rsquo;s say only localhost users can connect and only logged in users can lock and unlock entities. If a user is both logged in and on localhost then they will be able to both connect and lock/unlock entities.</p>'>?</a>",
+              "span": 6
+            }
+          ],
+
           "columns": [
             {
               "name": "permissions_id",
-              "label": "User/Group"
+              "label": ""
             },
             {
               "name": "id_can_connect",
@@ -117,7 +129,7 @@
             },
             {
               "name": "id_can_adjust_locks",
-              "label": "Lock/Unlock",
+              "label": "Lock / Unlock",
               "type": "checkbox",
               "editable": true,
               "default": false
@@ -131,7 +143,7 @@
             },
             {
               "name": "id_can_rez_tmp",
-              "label": "Rez Temp",
+              "label": "Rez Temporary",
               "type": "checkbox",
               "editable": true,
               "default": false
@@ -158,13 +170,24 @@
         {
           "name": "permissions",
           "type": "table",
-          "help": "Permissions for Specific Users:",
+          "caption": "Permissions for Specific Users",
           "can_add_new_rows": true,
 
+          "groups": [
+            {
+              "label": "User / Group",
+              "span": 1
+            },
+            {
+              "label": "Permissions <a data-toggle='tooltip' data-html='true' title='<p><strong>Connect</strong> &ndash; Sets whether a user can connect to the the domain.<br /><strong>Lock / Unlock</strong> &ndash; Sets whether a user change the &ldquo;locked&rdquo; property of an entity (either from on to off or off to on).<br /><strong>Rez</strong> &ndash; Sets whether a user can create new entities.<br /><strong>Rez Temporary</strong> &ndash; Sets whether a user can create new entities with a finite lifetime.<br /><strong>Write Assets</strong> &ndash; Sets whether a user can make changes to the domain&rsquo;s asset-server assets.<br /><strong>Ignore Max Capacity</strong> &ndash; Sets whether a user can connect even if the domain has reached or exceeded its maximum allowed agents.<br /></p><p>Note that permissions assigned to a specific user will supersede any parameter-level permissions that might otherwise apply to that user. Additionally, if more than one parameter is applicable to a given user, the permissions given to that user will be the sum of all applicable parameters. For example, let&rsquo;s say only localhost users can connect and only logged in users can lock and unlock entities. If a user is both logged in and on localhost then they will be able to both connect and lock/unlock entities.</p>'>?</a>",
+              "span": 6
+            }
+          ],
+
           "columns": [
             {
               "name": "permissions_id",
-              "label": "User/Group"
+              "label": ""
             },
             {
               "name": "id_can_connect",
@@ -175,7 +198,7 @@
             },
             {
               "name": "id_can_adjust_locks",
-              "label": "Lock/Unlock",
+              "label": "Lock / Unlock",
               "type": "checkbox",
               "editable": true,
               "default": false
@@ -189,7 +212,7 @@
             },
             {
               "name": "id_can_rez_tmp",
-              "label": "Rez Temp",
+              "label": "Rez Temporary",
               "type": "checkbox",
               "editable": true,
               "default": false
diff --git a/domain-server/resources/web/css/style.css b/domain-server/resources/web/css/style.css
index efb9e907c5..4c419a1baa 100644
--- a/domain-server/resources/web/css/style.css
+++ b/domain-server/resources/web/css/style.css
@@ -20,6 +20,17 @@ body {
   top: 40px;
 }
 
+.table .value-row td, .table .inputs td {
+    vertical-align: middle;
+}
+
+.table .table-checkbox {
+    /* Fix IE sizing checkboxes to fill table cell */
+    width: auto;
+    margin-left: auto;
+    margin-right: auto;
+}
+
 .glyphicon-remove {
   font-size: 24px;
 }
@@ -107,6 +118,21 @@ table {
   word-wrap: break-word;
 }
 
+caption {
+    color: #333;
+    font-weight: 700;
+    padding-top: 0;
+}
+
+table[name="security.standard_permissions"] .headers td + td, table[name="security.permissions"] .headers td + td {
+    text-align: center;
+}
+
+#security .tooltip-inner {
+    max-width: 520px;
+    text-align: left;
+}
+
 #xs-advanced-container {
   margin-bottom: 20px;
 }
diff --git a/domain-server/resources/web/settings/js/settings.js b/domain-server/resources/web/settings/js/settings.js
index 970e7551c4..aecc48b31f 100644
--- a/domain-server/resources/web/settings/js/settings.js
+++ b/domain-server/resources/web/settings/js/settings.js
@@ -233,7 +233,7 @@ $(document).ready(function(){
   });
 
   // Bootstrap switch in table
-  $('#' + Settings.FORM_ID).on('switchChange.bootstrapSwitch', 'input.table-checkbox', function () {
+  $('#' + Settings.FORM_ID).on('change', 'input.table-checkbox', function () {
     // Bootstrap switches in table: set the changed data attribute for all rows in table.
     var row = $(this).closest('tr');
     if (row.hasClass("value-row")) {  // Don't set attribute on input row switches prior to it being added to table.
@@ -851,7 +851,8 @@ function reloadSettings(callback) {
 
     // setup any bootstrap switches
     $('.toggle-checkbox').bootstrapSwitch();
-    $('.table-checkbox').bootstrapSwitch();
+
+    $('[data-toggle="tooltip"]').tooltip();
 
     // add tooltip to locked settings
     $('label.locked').tooltip({
@@ -928,6 +929,26 @@ function makeTable(setting, keypath, setting_value, isLocked) {
     + "' name='" + keypath + "' id='" + (typeof setting.html_id !== 'undefined' ? setting.html_id : keypath)
     + "' data-setting-type='" + (isArray ? 'array' : 'hash') + "'>";
 
+  if (setting.caption) {
+    html += "<caption>" + setting.caption + "</caption>"
+  }
+
+  // Column groups
+  if (setting.groups) {
+    html += "<tr class='headers'>"
+    _.each(setting.groups, function (group) {
+        html += "<td colspan='" + group.span  + "'><strong>" + group.label + "</strong></td>"
+    })
+    if (!isLocked && !setting.read_only) {
+        if (setting.can_order) {
+            html += "<td class='" + Settings.REORDER_BUTTONS_CLASSES +
+                    "'><a href='javascript:void(0);' class='glyphicon glyphicon-sort'></a></td>";
+        }
+        html += "<td class='" + Settings.ADD_DEL_BUTTONS_CLASSES + "'></td></tr>"
+    }
+    html += "</tr>"
+  }
+
   // Column names
   html += "<tr class='headers'>"
 
@@ -984,7 +1005,7 @@ function makeTable(setting, keypath, setting_value, isLocked) {
 
         if (isArray && col.type === "checkbox" && col.editable) {
           html += "<td class='" + Settings.DATA_COL_CLASS + "'name='" + col.name + "'>"
-                  + "<input type='checkbox' class='form-control table-checkbox' data-size='mini' "
+                  + "<input type='checkbox' class='form-control table-checkbox' "
                   + "name='" + colName + "'" + (colValue ? " checked" : "") + " /></td>";
         } else {
           // Use a hidden input so that the values are posted.
@@ -1039,7 +1060,7 @@ function makeTableInputs(setting) {
   _.each(setting.columns, function(col) {
     if (col.type === "checkbox") {
       html += "<td class='" + Settings.DATA_COL_CLASS + "'name='" + col.name + "'>"
-              + "<input type='checkbox' class='form-control table-checkbox' data-size='mini' "
+              + "<input type='checkbox' class='form-control table-checkbox' "
               + "name='" + col.name + "'" + (col.default ? " checked" : "") + "/></td>";
     } else {
       html += "<td class='" + Settings.DATA_COL_CLASS + "'name='" + col.name + "'>\
@@ -1176,7 +1197,7 @@ function addTableRow(add_glyphicon) {
       var input = $(element).find("input")
       var isCheckbox = false;
       if (input.hasClass("table-checkbox")) {
-        input = $(input).parent().parent();
+        input = $(input).parent();
         isCheckbox = true;
       }