diff --git a/domain-server/resources/describe-settings.json b/domain-server/resources/describe-settings.json
index 83c59f81a7..2965276969 100644
--- a/domain-server/resources/describe-settings.json
+++ b/domain-server/resources/describe-settings.json
@@ -460,7 +460,7 @@
           "groups": [
             {
               "label": "Group",
-              "span": 5
+              "span": 2
             },
             {
               "label": "Permissions <a data-toggle='tooltip' data-html='true' title='<p><strong>Domain-Wide User Permissions</strong></p><ul><li><strong>Connect</strong><br />Sets whether users in specific groups can connect to the domain.</li><li><strong>Lock / Unlock</strong><br />Sets whether users in specific groups can change the &ldquo;locked&rdquo; property of an entity (either from on to off or off to on).</li><li><strong>Rez</strong><br />Sets whether users in specific groups can create new entities.</li><li><strong>Rez Temporary</strong><br />Sets whether users in specific groups can create new entities with a finite lifetime.</li><li><strong>Write Assets</strong><br />Sets whether users in specific groups can make changes to the domain&rsquo;s asset-server assets.</li><li><strong>Ignore Max Capacity</strong><br />Sets whether user in specific groups can connect even if the domain has reached or exceeded its maximum allowed agents.</li></ul><p>Permissions granted to a specific user will be a union of the permissions granted to the groups they are in.  Group permissions are only granted if the user doesn&rsquo;t have their own row in the previous section.</p>'>?</a>",
@@ -475,20 +475,26 @@
             },
             {
               "name": "rank_id",
-              "label": "Rank ID"
+              "label": "Rank ID",
+              "readonly": true,
+              "hidden": true
             },
             {
               "name": "rank_order",
-              "label": "Rank Order"
+              "label": "Rank Order",
+              "readonly": true,
+              "hidden": true
             },
             {
               "name": "rank_name",
-              "label": "Rank Name"
+              "label": "Rank Name",
+              "readonly": true
             },
             {
               "name": "group_id",
               "label": "Group ID",
-              "readonly": true
+              "readonly": true,
+              "hidden": true
             },
             {
               "name": "id_can_connect",
@@ -543,7 +549,7 @@
           "groups": [
             {
               "label": "Group",
-              "span": 5
+              "span": 2
             },
             {
               "label": "Permissions <a data-toggle='tooltip' data-html='true' title='<p><strong>Domain-Wide User Permissions</strong></p><ul><li><strong>Connect</strong><br />Sets whether users in specific groups can connect to the domain.</li><li><strong>Lock / Unlock</strong><br />Sets whether users in specific groups can change the &ldquo;locked&rdquo; property of an entity (either from on to off or off to on).</li><li><strong>Rez</strong><br />Sets whether users in specific groups can create new entities.</li><li><strong>Rez Temporary</strong><br />Sets whether users in specific groups can create new entities with a finite lifetime.</li><li><strong>Write Assets</strong><br />Sets whether users in specific groups can make changes to the domain&rsquo;s asset-server assets.</li><li><strong>Ignore Max Capacity</strong><br />Sets whether user in specific groups can connect even if the domain has reached or exceeded its maximum allowed agents.</li></ul><p>Permissions granted to a specific user will be a union of the permissions granted to the groups they are in.  Group permissions are only granted if the user doesn&rsquo;t have their own row in the previous section.</p>'>?</a>",
@@ -558,20 +564,24 @@
             },
             {
               "name": "rank_id",
-              "label": "Rank ID"
+              "label": "Rank ID",
+              "hidden": true
             },
             {
               "name": "rank_order",
-              "label": "Rank Order"
+              "label": "Rank Order",
+              "hidden": true
             },
             {
               "name": "rank_name",
-              "label": "Rank Name"
+              "label": "Rank Name",
+              "readonly": true
             },
             {
               "name": "group_id",
               "label": "Group ID",
-              "readonly": true
+              "readonly": true,
+              "hidden": true
             },
             {
               "name": "id_can_connect",
diff --git a/domain-server/resources/web/settings/js/settings.js b/domain-server/resources/web/settings/js/settings.js
index 54be33e764..df4509a1ac 100644
--- a/domain-server/resources/web/settings/js/settings.js
+++ b/domain-server/resources/web/settings/js/settings.js
@@ -975,7 +975,8 @@ function makeTable(setting, keypath, setting_value, isLocked) {
   }
 
   _.each(setting.columns, function(col) {
-    html += "<td class='data " + (col.class ? col.class : '') + "'><strong>" + col.label + "</strong></td>" // Data
+    html += "<td " + (col.hidden ? "style='display: none;'" : "") + "class='data " +
+      (col.class ? col.class : '') + "'><strong>" + col.label + "</strong></td>" // Data
   })
 
   if (!isLocked && !setting.read_only) {
@@ -1027,8 +1028,9 @@ function makeTable(setting, keypath, setting_value, isLocked) {
                   + "name='" + colName + "' value='" + (colValue || col.default || "00:00") + "' /></td>";
         } else {
           // Use a hidden input so that the values are posted.
-          html += "<td class='" + Settings.DATA_COL_CLASS + "' name='" + colName + "'>"
-                  + colValue + "<input type='hidden' name='" + colName + "' value='" + colValue + "'/></td>";
+          html += "<td " + (col.hidden ? "style='display: none;'" : "") + "class='" + Settings.DATA_COL_CLASS +
+            "' name='" + colName + "'>" + colValue + "<input type='hidden' name='" + colName +
+            "' value='" + colValue + "'/></td>";
         }
 
       })
@@ -1081,7 +1083,7 @@ function makeTableInputs(setting) {
               + "<input type='checkbox' class='form-control table-checkbox' "
               + "name='" + col.name + "'" + (col.default ? " checked" : "") + "/></td>";
     } else {
-      html += "<td class='" + Settings.DATA_COL_CLASS + "'name='" + col.name + "'>\
+      html += "<td " + (col.hidden ? "style='display: none;'" : "") + "class='" + Settings.DATA_COL_CLASS + "'name='" + col.name + "'>\
                <input type='text' class='form-control' placeholder='" + (col.placeholder ? col.placeholder : "") + "'\
                value='" + (col.default ? col.default : "") + "' data-default='" + (col.default ? col.default : "") + "'" + (col.readonly ? " readonly" : "") + ">\
                </td>"
diff --git a/domain-server/src/DomainServerSettingsManager.cpp b/domain-server/src/DomainServerSettingsManager.cpp
index 665ce222ed..9d2d4c83ee 100644
--- a/domain-server/src/DomainServerSettingsManager.cpp
+++ b/domain-server/src/DomainServerSettingsManager.cpp
@@ -324,8 +324,34 @@ void DomainServerSettingsManager::validateDescriptorsMap() {
     }
 }
 
+
+void DomainServerSettingsManager::initializeGroupPermissions(NodePermissionsMap& permissionsRows,
+                                                             QString groupName, NodePermissionsPointer perms) {
+    // this is called when someone has used the domain-settings webpage to add a group.  They type the group's name
+    // and give it some permissions.  The domain-server asks api for the group's ranks and populates the map
+    // with them.  Here, that initial user-entered row is removed and it's permissions are copied to all the ranks
+    // except owner.
+
+    QString groupNameLower = groupName.toLower();
+
+    foreach (NodePermissionsKey nameKey, permissionsRows.keys()) {
+        if (nameKey.first.toLower() != groupNameLower) {
+            continue;
+        }
+        QUuid groupID = _groupIDs[groupNameLower];
+        QUuid rankID = nameKey.second;
+        GroupRank rank = _groupRanks[groupID][rankID];
+        if (rank.order == 0) {
+            // we don't copy the initial permissions to the owner.
+            continue;
+        }
+        permissionsRows[nameKey]->setAll(false);
+        permissionsRows[nameKey] |= perms;
+    }
+}
+
 void DomainServerSettingsManager::packPermissionsForMap(QString mapName,
-                                                        NodePermissionsMap& agentPermissions,
+                                                        NodePermissionsMap& permissionsRows,
                                                         QString keyPath) {
     // find (or create) the "security" section of the settings map
     QVariant* security = valueForKeyPath(_configMap.getUserConfig(), "security");
@@ -344,7 +370,7 @@ void DomainServerSettingsManager::packPermissionsForMap(QString mapName,
     // convert details for each member of the subsection
     QVariantList* permissionsList = reinterpret_cast<QVariantList*>(permissions);
     (*permissionsList).clear();
-    QList<NodePermissionsKey> permissionsKeys = agentPermissions.keys();
+    QList<NodePermissionsKey> permissionsKeys = permissionsRows.keys();
 
     // when a group is added from the domain-server settings page, the config map has a group-name with
     // no ID or rank.  We need to leave that there until we get a valid response back from the api.
@@ -353,20 +379,30 @@ void DomainServerSettingsManager::packPermissionsForMap(QString mapName,
     QHash<QString, bool> groupNamesWithRanks;
     // note which groups have rank/ID information
     foreach (NodePermissionsKey userKey, permissionsKeys) {
-        NodePermissionsPointer perms = agentPermissions[userKey];
+        NodePermissionsPointer perms = permissionsRows[userKey];
         if (perms->getRankID() != QUuid()) {
             groupNamesWithRanks[userKey.first] = true;
         }
     }
+    foreach (NodePermissionsKey userKey, permissionsKeys) {
+        NodePermissionsPointer perms = permissionsRows[userKey];
+        if (perms->isGroup()) {
+            QString groupName = userKey.first;
+            if (perms->getRankID() == QUuid() && groupNamesWithRanks.contains(groupName)) {
+                // copy the values from this user-added entry to the other (non-owner) ranks and remove it.
+                permissionsRows.remove(userKey);
+                initializeGroupPermissions(permissionsRows, groupName, perms);
+            }
+        }
+    }
 
     // convert each group-name / rank-id pair to a variant-map
     foreach (NodePermissionsKey userKey, permissionsKeys) {
-        NodePermissionsPointer perms = agentPermissions[userKey];
+        if (!permissionsRows.contains(userKey)) {
+            continue;
+        }
+        NodePermissionsPointer perms = permissionsRows[userKey];
         if (perms->isGroup()) {
-            if (perms->getRankID() == QUuid() && groupNamesWithRanks.contains(userKey.first)) {
-                // skip over the entry that was created when the user added the group.
-                continue;
-            }
             QHash<QUuid, GroupRank>& groupRanks = _groupRanks[perms->getGroupID()];
             *permissionsList += perms->toVariant(groupRanks);
         } else {
@@ -567,10 +603,17 @@ bool DomainServerSettingsManager::ensurePermissionsForGroupRanks() {
                 perms = _groupPermissions[nameKey];
             } else {
                 perms = NodePermissionsPointer(new NodePermissions(nameKey));
-                perms->setGroupID(groupID);
                 _groupPermissions[nameKey] = perms;
                 changed = true;
             }
+            if (perms->getGroupID() != groupID) {
+                perms->setGroupID(groupID);
+                changed = true;
+            }
+            if (perms->getRankID() != rankID) {
+                perms->setRankID(rankID);
+                changed = true;
+            }
             _groupPermissionsByUUID[idKey] = perms;
         }
     }
@@ -587,10 +630,17 @@ bool DomainServerSettingsManager::ensurePermissionsForGroupRanks() {
                 perms = _groupForbiddens[nameKey];
             } else {
                 perms = NodePermissionsPointer(new NodePermissions(nameKey));
-                perms->setGroupID(groupID);
                 _groupForbiddens[nameKey] = perms;
                 changed = true;
             }
+            if (perms->getGroupID() != groupID) {
+                perms->setGroupID(groupID);
+                changed = true;
+            }
+            if (perms->getRankID() != rankID) {
+                perms->setRankID(rankID);
+                changed = true;
+            }
             _groupForbiddensByUUID[idKey] = perms;
         }
     }
@@ -745,6 +795,7 @@ bool DomainServerSettingsManager::handleAuthenticatedHTTPRequest(HTTPConnection
             QTimer::singleShot(DOMAIN_SERVER_RESTART_TIMER_MSECS, qApp, SLOT(restart()));
         } else {
             unpackPermissions();
+            apiRefreshGroupInformation();
             emit updateNodePermissions();
         }
 
@@ -1272,8 +1323,6 @@ void DomainServerSettingsManager::apiGetGroupRanks(const QUuid& groupID) {
 }
 
 void DomainServerSettingsManager::apiGetGroupRanksJSONCallback(QNetworkReply& requestReply) {
-
-
     // {
     //     "data":{
     //         "groups":{
@@ -1420,16 +1469,11 @@ void DomainServerSettingsManager::debugDumpGroupsState() {
     qDebug() << "_groupRanks:";
     foreach (QUuid groupID, _groupRanks.keys()) {
         QHash<QUuid, GroupRank>& ranksForGroup = _groupRanks[groupID];
-        QString readableRanks;
+        qDebug() << "|  " << groupID;
         foreach (QUuid rankID, ranksForGroup.keys()) {
             QString rankName = ranksForGroup[rankID].name;
-            if (readableRanks == "") {
-                readableRanks = rankName;
-            } else {
-                readableRanks += "," + rankName;
-            }
+            qDebug() << "|      " << rankID << rankName;
         }
-        qDebug() << "|  " << groupID << "==>" << readableRanks;
     }
 
     qDebug() << "_groupMembership";
diff --git a/domain-server/src/DomainServerSettingsManager.h b/domain-server/src/DomainServerSettingsManager.h
index 61642d4914..f56b1ecd21 100644
--- a/domain-server/src/DomainServerSettingsManager.h
+++ b/domain-server/src/DomainServerSettingsManager.h
@@ -125,7 +125,8 @@ private:
     void apiGetGroupID(const QString& groupName);
     void apiGetGroupRanks(const QUuid& groupID);
 
-    void packPermissionsForMap(QString mapName, NodePermissionsMap& agentPermissions, QString keyPath);
+    void initializeGroupPermissions(NodePermissionsMap& permissionsRows, QString groupName, NodePermissionsPointer perms);
+    void packPermissionsForMap(QString mapName, NodePermissionsMap& permissionsRows, QString keyPath);
     void packPermissions();
     void unpackPermissions();
     bool ensurePermissionsForGroupRanks();
diff --git a/libraries/networking/src/NodePermissions.h b/libraries/networking/src/NodePermissions.h
index 6d12c4cf7e..37aea6dd05 100644
--- a/libraries/networking/src/NodePermissions.h
+++ b/libraries/networking/src/NodePermissions.h
@@ -34,6 +34,7 @@ public:
     NodePermissions(QMap<QString, QVariant> perms);
 
     QString getID() const { return _id; } // a user-name or a group-name, not verified
+    void setRankID(QUuid& rankID) { _rankID = rankID; }
     QUuid getRankID() const { return _rankID; }
     NodePermissionsKey getKey() const { return NodePermissionsKey(_id, _rankID); }
 
@@ -116,6 +117,7 @@ public:
     QList<NodePermissionsKey> keys() const { return _data.keys(); }
     QHash<NodePermissionsKey, NodePermissionsPointer> get() { return _data; }
     void clear() { _data.clear(); }
+    void remove(const NodePermissionsKey& key) { _data.remove(key); }
 
 private:
     QHash<NodePermissionsKey, NodePermissionsPointer> _data;