How to check which user changed SharePoint Intranet site?

Question

We have a SharePoint intranet, was accidentally changed by user significantly:

1. The fonts and styles are all wrong.
2. The menu from the Settings Cog on the top right corner also has different font styles.

I have just now locked down users permissions, so that only admin users are allowed to change, ordinary users should have read only access. It is a bit too late.

Questions:

1. Where could the user made the change?
2. What is the best way to reverse the change?
3. Can I find out who made the change?

Thanks

Answer 1

There are a few things the user could have done:

1. Change the "theme" of the site. This is most likely the case if the changes are only applied to one site/subsite, and not your entire site collection. This can be changed back by clicking on the gear, selecting "Site Settings", and then clicking on the "Change the Look" link.
2. Change the master page for the site. This can be changed back to the default by going to Site Settings again and clicking on the "Master Page" link under Look and Feel.
3. They EDITED the existing Master Page. This would have bee done through SharePoint Designer, and would need to be fixed through SharePoint Designer. (Find the Master Page in the Master Page Gallery, right click on it, and then select "Reset to Site Definition".
4. They simply applied a custom stylesheet. This can be reverted to the default by again going to Site Settings, and clicking on the "Master Page" link under Look and Feel.

(In SharePoint 2013, you can actually revert the theme, css, and master page all from the "Master Page" link in Site Settings.)