diff --git a/generic/forms.py b/generic/forms.py
index f09f278b..b53232d5 100755
--- a/generic/forms.py
+++ b/generic/forms.py
@@ -206,23 +206,30 @@ class ExamGroupsFormMixin(ModelForm):
         def __init__(self, *args, user, **kwargs) -> None:
             super(ModelForm, self).__init__(*args, **kwargs)
 
+            # TODO: decide how we should handle managing user groups
+            # i.e who should be able to access a list of all users?
+
             if user.is_superuser or user.groups.filter(name="cid_user_manager").exists():
                 cid_user_group_queryset = CidUserGroup.objects.filter(archive=False)
                 user_user_group_queryset = UserUserGroup.objects.filter(archive=False)
             else:
-                cid_user_group_queryset = CidUserGroup.objects.none()
-                user_user_group_queryset = UserUserGroup.objects.none()
+                cid_user_group_queryset = CidUserGroup.objects.filter(archive=False, open_access=True)
+                user_user_group_queryset = UserUserGroup.objects.none(archive=False, open_access=True)
             #cid_user_group_queryset = CidUserGroup.objects.none()
             #user_user_group_queryset = UserUserGroup.objects.none()
 
             self.fields["cid_user_groups"] = ModelMultipleChoiceField(
                 required=False,
                 queryset=cid_user_group_queryset,
+                label="CID User Groups",
             )
             self.fields["user_user_groups"] = ModelMultipleChoiceField(
                 required=False,
                 queryset=user_user_group_queryset,
+                label="User Groups",
             )
+            self.fields["cid_user_groups"].widget.attrs["size"] = 8
+            self.fields["user_user_groups"].widget.attrs["size"] = 8
 
 
 class ExaminationForm(ModelForm):
@@ -414,7 +421,7 @@ class CidUserGroupModelChoiceField(ModelMultipleChoiceField):
 class CidUserGroupForm(ModelForm):
     class Meta:
         model = CidUserGroup
-        fields = ["name", "archive"]
+        fields = ["name", "archive", "open_access"]
 
 
 class UserUserGroupModelChoiceField(ModelMultipleChoiceField):
@@ -431,7 +438,7 @@ class UserUserGroupForm(ModelForm):
 
     class Meta:
         model = UserUserGroup
-        fields = ["name", "archive", "users"]
+        fields = ["name", "archive", "open_access", "users"]
 
 
 class UserGroupExamForm(ModelForm):
diff --git a/generic/templates/generic/exam_cids_edit.html b/generic/templates/generic/exam_cids_edit.html
index f37921f3..d2600827 100644
--- a/generic/templates/generic/exam_cids_edit.html
+++ b/generic/templates/generic/exam_cids_edit.html
@@ -22,7 +22,7 @@
     {% endfor %}
 </ol>
 
-        {% comment %} Hide the toggle button if there are no users (to add or remove) {% endcomment %}
+{% comment %} Hide the toggle button if there are no users (to add or remove) {% endcomment %}
 {% if current_cid_users or available_cid_users %}
     <p><button class="toggle-all-btn">Toggle all</button></p>
 {% endif %}
diff --git a/generic/templates/generic/exam_groups_edit.html b/generic/templates/generic/exam_groups_edit.html
index 97dcd919..8059b213 100644
--- a/generic/templates/generic/exam_groups_edit.html
+++ b/generic/templates/generic/exam_groups_edit.html
@@ -6,6 +6,10 @@
 
     <h3>Groups</h3>
 
+    <p>Groups are used to control will users are available for the exam.  If a user is not in a group, they will not be available to add to the exam.</p>
+    <p>Muliple groups can be added to an exam.</p>
+    <p>Two type of groups exist. CID groups are used for external candidates. User groups are used for internal candidates.</p>
+
     <form action="" method="post">
         {% csrf_token %}
         <table>
diff --git a/generic/templates/generic/exam_users_edit.html b/generic/templates/generic/exam_users_edit.html
index a0c13c96..2fde1ff4 100644
--- a/generic/templates/generic/exam_users_edit.html
+++ b/generic/templates/generic/exam_users_edit.html
@@ -30,7 +30,10 @@
     {% endfor %}
 </ol>
 
-<p><button class="toggle-all-btn">Toggle all</button></p>
+{% comment %} Hide the toggle button if there are no users (to add or remove) {% endcomment %}
+{% if current_cid_users or available_cid_users %}
+    <p><button class="toggle-all-btn">Toggle all</button></p>
+{% endif %}
 
 <script>
     $(document).ready(() => {
diff --git a/generic/views.py b/generic/views.py
index 32d44bea..e49e1009 100644
--- a/generic/views.py
+++ b/generic/views.py
@@ -1207,7 +1207,7 @@ class ExamViews(View, LoginRequiredMixin):
 
             elif not self.check_user_edit_access(request.user, exam_id=pk):
                 data = {"status": "invalid permisions"}
-                return JsonResponse(data, status=400)
+                return JsonResponse(data, status=403)
 
             exam = get_object_or_404(self.Exam, pk=pk)