diff --git a/admin/reindexer-1.0.groovy b/admin/reindexer-1.0.groovy
index 5c32773..c3cc673 100644
--- a/admin/reindexer-1.0.groovy
+++ b/admin/reindexer-1.0.groovy
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import com.google.gerrit.common.data.GlobalCapability
 import com.google.gerrit.sshd.*
 import com.google.gerrit.extensions.annotations.*
 import com.google.gerrit.lucene.*
@@ -20,6 +21,7 @@
 
 @Export("start")
 @CommandMetaData(name = "start", description = "Start a new on-line re-indexing for a target Lucene index version")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class StartReindex extends SshCommand {
 
   @Inject OnlineReindexer.Factory reindexerFactory
diff --git a/admin/warm-cache-1.0.groovy b/admin/warm-cache-1.0.groovy
index 5b1d75b..5ba12c2 100644
--- a/admin/warm-cache-1.0.groovy
+++ b/admin/warm-cache-1.0.groovy
@@ -12,10 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import com.google.gerrit.common.data.GlobalCapability
 import com.google.gerrit.sshd.*
 import com.google.gerrit.extensions.annotations.*
 import com.google.gerrit.server.project.*
 import com.google.gerrit.server.account.*
+import com.google.gerrit.server.IdentifiedUser
 import com.google.gerrit.reviewdb.client.AccountGroup
 import com.google.gerrit.reviewdb.server.ReviewDb
 import com.google.inject.*
@@ -30,11 +32,16 @@
 }
 
 @Export("projects")
+@CommandMetaData(description = "Warm-up project_list and projects caches")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class WarmProjectsCache extends BaseSshCommand {
 
   @Inject
   ProjectCache cache
 
+  @Inject
+  GroupCache groupCache
+
   public void run() {
     println "Loading project list ..."
     def start = System.currentTimeMillis()
@@ -56,6 +63,7 @@
 }
 
 @Export("groups")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class WarmGroupsCache extends WarmProjectsCache {
 
   @Inject
@@ -102,6 +110,7 @@
 }
 
 @Export("accounts")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class WarmAccountsCache extends BaseSshCommand {
 
   @Inject
@@ -135,5 +144,37 @@
   }
 }
 
-commands = [ WarmProjectsCache, WarmGroupsCache, WarmAccountsCache ]
+@Export("groups-backends")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
+class WarmGroupsBackendsCache extends WarmAccountsCache {
+
+  @Inject
+  IdentifiedUser.GenericFactory userFactory
+
+  public void run() {
+    println "Loading groups ..."
+    def start = System.currentTimeMillis()
+    def allAccounts = db.get().accounts().all()
+    def loaded = 0
+    def allGroupsUUIDs = new HashSet<AccountGroup.UUID>()
+    def lastDisplay = 0
+
+    for (account in allAccounts) {
+      def user = userFactory.create(account.accountId)
+      def groupsUUIDs = user?.getEffectiveGroups()?.getKnownGroups()
+      if (groupsUUIDs != null) { allGroupsUUIDs.addAll(groupsUUIDs) }
+
+      loaded = allGroupsUUIDs.size()
+      if (loaded.intdiv(1000) > lastDisplay) {
+        println "$loaded groups"
+        lastDisplay = loaded.intdiv(1000)
+      }
+    }
+
+    def elapsed = (System.currentTimeMillis()-start)/1000
+    println "$loaded groups loaded in $elapsed secs"
+  }
+}
+
+commands = [ WarmProjectsCache, WarmGroupsCache, WarmAccountsCache, WarmGroupsBackendsCache ]