Hello, I'm using Server 2008 R2, SCCM 2007 sp1, fully patched. When setting the Discovery Methods, System Group Discovery and Security Group Discovery, do I have to point it to a specific OU? What is the difference between the two? For example, should I create an OU and put every Security Group in that OU and target it for the Security Group Discovery? Can I point the System Group Discovery at the base DN and assume it will find every machine?

Both system group discovery and I think (I'd have to double-check) Security group discovery for computers will only create discovery records if the computer already exists in the database. I.e., if the computer must already have a record, usually from Heartbeat (Data Discovery) or from System Discovery, if you wanted to use System Discovery. Some organizations do, others don't. We just use Heartbeat for computers to create their initial record in the database. then system group discovery has something to attach to when it runs. That said, yes, you can just point to the base DN, and it will find every machine which already has a record in your database, and gather additional information about it.Standardize. Simplify. Automate.

I'm using Server 2008 R2, SCCM 2007 sp1, fully patched. That's not supported. You need ConfigMgr 2007 SP2 if the server is running on Server 2008 R2! "Include groups" is only needed if the OU does not contain the computer accounts (but only the group; BIZ_Workstations in your case). See ad*.log if the computer was successfully discovered. Plus: have you already updated to collection membership and refreshed the console afterwards? That's needed to show the changes after discovery has run.

I'm not sure how I tell if I'm on sp2, but I think I am. My version says 4.00.6221.1000

My version says 4.00.6221.1000 That's SP1.