Alright, first let me say that I am used to playing the 3rd/3.5 edition of D&D, and have come to rely on the Challenge Rating system for just what is challenging and what is not... Shadowrun 4th says that using the Prime Runners and Professional Rating systems should be enough, but, the systems don't really tell you how to create an NPC as far as point totals and such (other than the Primer Runners, which works basically like a PC).

For example here... I looked at all the sample Contact NPCs, and came up with this information:

204 BP - Bartender (150ish on attributes)
228 BP - Beatcop (150ish on attributes)
218 BP - Blogger (150ish on attributes)
308 BP - Fixer (200ish on attributes)
286 BP - Mafia Consiglieri (200ish on attributes)
258 BP - Mechanic (175ish on attributes)
314 BP - Mr Johnson (200ish on attributes)
266 BP - Street Doc (175ish on attributes)
266 BP - Talismonger (175ish on attributes)

I began doing the same work with some of the grunts:

110 BP - Humanic Policlub Goon (90 on attributes)
178 BP - Humanis Lieutenant (140 on attributes)
154 BP - Halloweener (120 on attributes)

Now, obviously grunts should have fewer BP then other NPCs, as they're meant to be tackled in larger groups...

My question is, how do you other Shadowrun 4th GMs create the stats for your grunts and other NPCs? Do you use any point cap for non-Prime Runner NPCs? Vague boundaries? How do you do this?

I'm kind of all over the place on these. It really depends on the NPC, how developed I want/need them to be, and what their role is in the game. But generally 350 or less.

I like to throw in enough points to ensure the PCs have absolutely no chance for success. And then laugh, maniacally.

BPs can't really be used as a measure of challenge for the PCs. You could build a mercenary and a hooker with 300BP each and they'll be comepletely different levels of threats. There are only a few ways to really generate threat levels in SR:

a) eyeball it and change it if necessary during the game

b) do the math regarding expected hits on opposed tests. For example the Johnson has 12 negotiatiions dice and so expects 4 hits, the face has 16 negotiation dice and expects 5 hits. If you want the Johnson to win the test you'll have to get lucky, fudge, or up his skill.

c) generate what you feel is appropriate for the run and stick to it

Do what my GM does, get a broad concept and wing it from there. Anyone who is supposed to be a threat is a little better at stuff than the PCs, anyone who is a nuisance is a little worse at stuff than the PCs.

To add onto what James said; I certainly agree with the mercenary vs. hooker example, the situation also changes thing so much. Consider how threatening the mercenary is when he's being ambushed alone by the PCs. He's going to be completely owned in the first pass and is a non-challenge. What if the hooker attacks the PCs while they're wounded or lightly armed, or maybe just takes a cheap shot at them from a rooftop with cover. Suddenly she becomes a serious threat to the entire team.
Context is just as important, if not more important, than ability in determining the threat of an enemy. In a game like SR, you really can't assign NPC's "challenge ratings" like you can in that other game. Sure, one NPC might be inherently scarier than another, and that could be a starting point, but circumstances can swing the balance so very, very far.

Hmm, mostly I am worried my NPCs will be too tough or too weak, I'll be GMing Shadowrun for the first time this weekend, and I'd rather not destroy the whole party on accident on the first go. On the other hand, the party features a nasty brute of a troll and a mage with a combat spell focus, and I don't want them to stomp through the opposition without worry.

It takes some getting used to, in general, what our GM does is throw NPC meat into the grinder and slowly ups the level of the NPCs until he finds what we can and can't handle.

In general, the idea of matching average hits is probably what you're looking for. If you brute troll swings with 13 dice, you'll want a character with 10-16 dice to make a match for him. Or some one weak and out of melee range if he's a melee guy.

(Would a 300bp Hooker have Kama Sutra as an active skill?)

Build points is not a good measure of threat rating. The mechanic street dock and tails monger would be far les dangerous than the beat cop.

Personally I don’t consider the value of the abilities I give NPCs.

For a combat encounter an NPCs threat level would be determined buy the combination of several factors.

Quality of tactics used
Initiative (score and actions)
Offensive dice pool
Damage
Defensive dice pools (dodge and soak)

This is approximately the order of importance.

Consider these 2 threats.

The most heavily engendered cyber zombie created buy aztechnolagy, with anchored spells is standing around in an open aria with only short range weapons.

A 50 BP rigger (no physical stats to speak of, only core rigging skills and only at about 3) with 4 steal lynx drones (mounting Aries Alfa with gel rounds and offensive concussion grenades) defending a confined aria.

The first allows you to kill him from out of range, the second you get minced buy drones worth les than 2BP each.

Edward

Sigged

I would generally go by what an NPC of that level should be like in that game world, skill-wise. Yeah, you should match challenges to the PCs when it comes to things like rival runner teams and the like, but you shouldn't give an ordinary, average security guard a skill of 6 in pistols just because the troll sammie has a high Body. If you need more of a challenge, it's better to increase the number of opponents. Also remember that PCs will often have to go through several running battles before they can rest or recuperate, so a light wound here or there can really add up.