Don't create a separate forest or domain, more times than not it just complicates things. 

I suggest a different OU, that's what they are there for.

Just create 1 forest and 1 domain and add them into various OUs?

We have a ton of random "utility" servers running either Windows XP, Windows 2003, or Windows 2008, all standalone in Workgroup mode. One is the AV console, one is an HVAC server,  etc.  

For those of you in the same boat, did you setup an AD tree and join all these servers to it?  Are they in your production tree?  A separate tree?  Just leave it alone?

Thanks for any suggestions!

Central authentication for random Windows servers?