when the domain controllers automatically renew those certificates above, will they know to look at the subordinate CA for the renewal/issuance of a new certificate based on those templates required for a domain controller?
yes. Enrollment clients will enumerate all CAs that support requested template from AD first. Then client will choose random CA from this list to send renewal request. That is, removing all templates from root CA is fine, clients will attempt another available CA that supports this template.
p.s. though I would consider to convert Enterprise Root CA (domain-joined) to Standalone Root CA (workgroup member) so you can turn off root CA for most of time because it has nothing to do online. You would turn on it once or twice a year to publish the CRL or when you need to sign subordinate CA certificate. But it is another question, just a good way to follow best practices.
Update 1 (21.01.2022)
Microsoft Docs pages don't show anything about how it enumerates the CAs, etc.
Enrollment client calls generic IX509Enrollment::Enroll which performs a series of calls (very simplified steps):
CA discovery using [MS-XCEP]
- Load a list of policies from registry.
- Group policies by PolicyId attribute.
- Groups are sorted by Cost attribute, then by Authentication attribute. Kerberos authentication has higher precedence. The rest groups are placed in arbitrary order.
- Query each policy by calling IPolicy::GetPoliciesResponse web method. Response contains a list of CA web services
- Response contains: a list of certificate templates the caller has permissions to enroll and a list of CA endpoints (that implement [MS-WSTEP] protocol) with the information about supported certificate templates.
- prepare empty list.
- for each sorted policy group:
- order CAs by Cost attribute, then by Authentication attribute. Kerberos authentication has higher precedence. The rest groups are placed in arbitrary order. Eliminate CAs the caller has no permissions on. Append ordered CAs to the list in same order.
- repeat (8) until all CAs are added to the list.
- for each CA in remaining list:
- generate certificate request and call ICertRequest::Submit to submit request to selected CA.
- repeat (11) until the call succeeds.
CA discovery using [MS-WCCE]
- do do-while loop call of ICertConfig::Next to enumerate all autodiscovered CAs (local, registered in AD, stored in shared directory, etc.). This will produce a list of all possible CAs.
- For each CA client makes a
ICertRequest2::GetCAProperty
call with CR_PROP_TEMPLATES
as a propID
parameter. Eliminate offline CAs.
- Filter list obtained in (1) to eliminate CAs that does not support requested template.
- if CA site awareness is configured, filter list of CAs that are in same ADDS site as client. Do not filter if CA site awareness is not configured or there is no CAs in same ADDS site where client resides.
- Call ICertRequest::GetCACertificate to retrieve CA certificate and validate each. Eliminate CAs with invalid or untrusted certificate.
- pick arbitrary CA from remaining list, generate certificate request and call ICertRequest::Submit to submit request to selected CA.
Again, it is a simplified task sequence for enrollment client to discover CAs and submit certificate request.
Update 2
Do you know what affect existing certs will have that were issued from the existing SubCA after we replace the rootCA?
literally nothing as long as root CA is trusted by clients.