Child domain or new forest?

[mikedisd]

I have a single corporate domain with 2x DCs (svr 2008R2) and want to create a new domain to contain kiosk and training room PCs that will be used by the public. I want the kiosk domain to be managed by the corporate domain's SCCM 2012 and to receive software updates, new applications and deployments. Security is obviously a big concern; the kiosk machines will be heavily locked down with group policies, scripts etc. Is it better from a security perspective to have the kiosk domain in a different forest or does a child domain suffice?

[zenvenky]

I would go with saperate forest as it isn't required to contact main corporate domain to utilize any domain resource.