Investigate and Undo a User's Changes
Find everything one person did, check it, and put things back — safely, without overwriting later work.
When to use this
Use this when someone has made changes they should not have, whether by mistake or on purpose. For example, a leaver deleting records or changing settings on their way out.
1. Stop further damage first
Disable the person's user account, or change their role to one with no access, before anything else. Also revoke any API keys they created (Settings → Developers).
2. Find what they did
- Open Settings → Audit Trail.
- In Person, search for them by name or email.
- Set Time frame to cover the period, or choose Custom range….
- Optionally set Action to Deleted or Category to Security & policies to see the most serious changes first.
- Click Export CSV to keep a copy of the evidence before you change anything.
Also check for failed or refused attempts. Set Outcome to Refused for that person, which shows what they tried to do but were not allowed.
3. Check each change
Click a row to see exactly which fields changed and their old values. Use Full history of this record to see whether anyone else has changed the record since.
4. Undo
- One change: open the entry and click Revert this change.
- Many changes: tick the rows in the list and click Revert selected. They are undone newest first.
What undoing does:
| The change was | Revert will |
|---|---|
| An edit | Put back the old values of the fields it changed |
| A deletion | Re-create the record from its saved copy, with the same ID |
| A creation | Delete the record |
Later work is never overwritten
A field is only put back if it still holds the value this change gave it. If someone has changed that field again since, it is left alone, and the result tells you which fields were skipped and their current value. Fix those by hand if needed.
Some things can't be restored automatically:
- secret values such as passwords and API keys, which were never stored. Set them again;
- a record that can't be re-created, for example because a record it linked to has also been deleted. Restore that one first, then try again;
- edits made as part of a larger multi-step operation, where the earlier value was not captured. The entry says previous value unknown.
Every revert is recorded in the audit trail itself, linked to the change it undid, and the original entry is marked Reverted with who did it and when.
Who can do this
Only administrators can revert changes. HR administrators can view the trail but not revert.
Was this article helpful?