I created a subordinate "enterprise" CA server using ADCS on an active directory domain. The root CA that signed this subordinate CA's cert is not part of the windows domain.
Q1: Does the active directory domain automatically trust the root CA that signed the subordinate CA's cert? Microsoft ADCS has access to this root CA cert (when I loaded the signed subordinate cert into the CA) and there is no reason for ADCS to not send the cert out to all domain members.
Q2: If not, what is the canonical/proper way to get the domain members to trust the root CA?
You will need to export the root CA certificate (to a USB stick if the ROOT CA is - hopefully - not network connected). You then need to publish the certificate to AD using certutil -dspublish RootCACertificate RootCA. Once this is done, all domain-joined computers will get the certificate added to their list of Trusted Root Certification Authorities and should then start to trust your subordinate CAs.