diff --git a/confluent/config/configmanager.py b/confluent/config/configmanager.py
index 85a31ef6..4feebcce 100644
--- a/confluent/config/configmanager.py
+++ b/confluent/config/configmanager.py
@@ -405,6 +405,11 @@ class ConfigManager(object):
             return False
         return True
 
+    def get_groups(self):
+        if 'groups' not in self._cfgstore:
+            return []
+        return self._cfgstore['groups'].iterkeys()
+
     def get_nodes(self):
         if 'nodes' not in self._cfgstore:
             return []
diff --git a/confluent/messages.py b/confluent/messages.py
index 9ea85ecd..466c885f 100644
--- a/confluent/messages.py
+++ b/confluent/messages.py
@@ -231,7 +231,6 @@ class ListAttributes(ConfluentMessage):
         }
 
 class CryptedAttributes(Attributes):
-    defaultvalue = 'dummyvalue'
     defaulttype = 'password'
 
     def __init__(self, node, kv):
diff --git a/confluent/pluginapi.py b/confluent/pluginapi.py
index 63a044d4..31d855a1 100644
--- a/confluent/pluginapi.py
+++ b/confluent/pluginapi.py
@@ -134,6 +134,11 @@ def handle_path(path, operation, configmanager, inputdata=None):
         del pathcomponents[-1]
     if not pathcomponents: #root collection list
         return enumerate_collections(rootcollections)
+    elif pathcomponents[0] == 'nodegroup':
+        try:
+            group = pathcomponents[1]
+        except IndexError:
+            return iterate_collections(configmanager.get_groups())
     elif pathcomponents[0] in ('node', 'system', 'vm'):
         #single node request of some sort
         try:
diff --git a/plugins/configuration/attributes.py b/plugins/configuration/attributes.py
index 69323d0e..abbe487d 100644
--- a/plugins/configuration/attributes.py
+++ b/plugins/configuration/attributes.py
@@ -8,11 +8,16 @@ def retrieve(nodes, element, configmanager, inputdata):
             for attribute in sorted(allattributes.node.iterkeys()):
                 if attribute in attributes[node]: #have a setting for it
                     val = attributes[node][attribute]
+                elif attribute == 'groups': # no setting, provide a blank
+                    val = []
                 else: # no setting, provide a blank
                     val = {'value': '', 'cryptvalue': ''}
                 if attribute.startswith('secret.'):
                     yield msg.CryptedAttributes(node,
                         {attribute: val})
+                elif isinstance(val, list):
+                    yield msg.ListAttributes(node,
+                        {attribute: val})
                 else:
                     yield msg.Attributes(node,
                         {attribute: val['value']})