Certificate Authority Has Too Many Root Certificates

I think your understanding if this issue is incorrect.  The output so far looks fine, there are probably just some followup tasks you need to do as I am imagining when you renewed the CA cert that you did so using a new keyset.

Your existing certs should be fine as the CRL from the original is still valid.  Looks like you never issued a CRL from the first renewal, but have from this instance.  That CRL needs to be pushed to your CDP locations.

You need to take a copy of this new root CA cert and deploy that to your clients via GPO or whatever methods you have used previously.  Do not remove the old root certificate from GPO, etc. - it is fine (and until you renew all the old certs important) to leave it there.

Since your environment presumably does not trust the new CA cert then that can get in the way of issuance.

Also, check your AIA locations and copy the CA cert to those locations as well.  The new CRLs may have a (2) at the end of the filename, for example RootCA(2).crl for the base crl, RootCA(2)+.crl for the delta if you have one.  If you have a script to copy the CRLs out, if they were specifying the exact file name you may need to adjust that - it may be easiest to just copy *.crl form the certenroll directory.

After that, you can wait for AD to replicate and if it is 2003/vista/2008 (or xp with 2003 adminpak installed to have access to certutil) then you can issue 'gpupdate /force' (or reboot) to push the new cert down, then 'certutil -pulse' to pulse autoenrollment events.  For xp without the adminpak then you can just do the gpupdate and reboot or wait.  For LDAP servers (usually just your DC's) if they need to renew then you will need to reboot after the new cert is applied to have it used instead of the old cached one.

If you are still having problems, run pkiview.msc and check that.  If still having problems after that, post back and let me know what exactly isn't working and if there are any unique considerations (works for these but not these, etc.)

The CA Cert Count just reflects that you had 1 cert originally and that it has been renewed 2 times.  Even though there are 2 that are valid that's perfectly fine.  Normally you should be renewing before the old one expires, so this is not abnormaly behavior.

rewarding points for detail of answer. we actually, though, just ended up uninstalling the root ca and installing on another server which seems to have worked fine for us.