diff --git a/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config.jelly b/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config.jelly
index 7167d04c044afcc0138f3dbd3333153083eeefb4..5d026e57bc859ddd8b69c5146872dd3bae814337 100644
--- a/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config.jelly
+++ b/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config.jelly
@@ -23,7 +23,7 @@ THE SOFTWARE.
 -->
 
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-	<f:block xmlns:local="local">
+  <f:block xmlns:local="local">
     <j:set var="groups" value="${descriptor.allGroups}"/>
     <d:taglib uri="local">
       <!-- generate one row for the sid name @sid -->
@@ -99,11 +99,16 @@ THE SOFTWARE.
         <local:row sid="${null}" />
       </tr>
     </table>
-    <div style="margin-top:0.5em; margin-left: 2em;">
+    <table style="margin-top:0.5em; margin-left: 2em; width: 100%">
+     <tr><td colspan="3">
       ${%User/group to add}:
       <input type="text" id="${id}text" />
       <input type="button" value="${%Add}" id="${id}button"/>
-    </div>
+     </td><td align="right">
+      <a href="#" class="help-button" helpURL="${rootURL}${descriptor.find('hudson.security.GlobalMatrixAuthorizationStrategy$DescriptorImpl').getHelpFile('user-group')}"><img src="${imagesURL}/16x16/help.gif" alt="[help]"/></a>
+     </td></tr>
+     <f:helpArea />
+    </table>
     <script>
       (function() {
         <!-- place master outside the DOM tree so that it won't creep into the submitted form -->
diff --git a/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-user-group.html b/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-user-group.html
new file mode 100644
index 0000000000000000000000000000000000000000..1086c6854227d1a56eac6113aef99500b433cbc0
--- /dev/null
+++ b/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-user-group.html
@@ -0,0 +1,8 @@
+<div>
+  Note that adding permissions for LDAP groups requires a specific syntax.  In the
+  default configuration all LDAP groups must be entered here in all capital letters
+  and with "ROLE_" added on the front.  For example, a group called "devs" would be
+  entered here as "ROLE_DEVS".  The prefix and case settings may be adjusted by
+  editing the <tt>WEB-INF/security/LDAPBindSecurityRealm.groovy</tt> file in your
+  Hudson deployment and restarting Hudson.
+</div>
diff --git a/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help.html b/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help.html
index a281efa1b5f5476a321d7ba17b3fac96130f5150..c34beb46b3b76d725cf970dd0a20cefea11fd1a7 100644
--- a/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help.html
+++ b/core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help.html
@@ -16,12 +16,4 @@
   Permissions are additive. That is, if an user X is in group A, B, and C, then
   the permissions that this user actually has are the union of all permissions given to
   X, A, B, C, and anonymous.
-
-  <p>
-  Note that adding permissions for LDAP groups requires a specific syntax.  In the
-  default configuration all LDAP groups must be entered here in all capital letters
-  and with "ROLE_" added on the front.  For example, a group called "devs" would be
-  entered here as "ROLE_DEVS".  The prefix and case settings may be adjusted by
-  editing the <tt>WEB-INF/security/LDAPBindSecurityRealm.groovy</tt> file in your
-  Hudson deployment and restarting Hudson.
 </div>