Not sure about the particular implementation in Active Directory, but in general X.509 signing it allows for much easier recovery from a compromise.
Its assumed that an on-line CA is much more vulnerable than an offline one. So, let's say your online CA is compromised, and its private key is potentially copied.
You revoke the CA certificate. You go ahead and generate a new keypair, certificate, etc—you have a new online CA now.
Your next step depends on if you have an offline CA or not:
If you have an offline CA, you use your offline CA to sign your new online CA certificate. Fairly easy. More secure, too, as its easy enough you'll probably actually do it.
If you do not have an offline CA, you go install your new root CA certificate on each and every client machine, phone, tablet,…. (Actually, you don't: you set up an offline CA, and install that instead. Because you learned not to repeat this mistake!) Less secure, because you're going to do your best to avoid this work. ("Are we really sure the private key was stolen?")
Finally, you sign new certificates for the servers, and install them (possibly including the CA chain).
So, in summary, if you have an offline CA, you only have to re-issue certificates for authenticating side (typically, only the server). If you don't, not only do that, you get to install your new root CA everywhere.