When geoportal connects to ArcGIS Server to harvest content it does so not with the user's identity. hence the windows authentication on your ArcGIS Server would consider the geoportal server an anonymous user and respond accordingly.
A workaround is to create metadata descriptions for the service using the metadata editor or using an external editor and then uploading the metadata XML. In the metadata you (a known windows identity) can paste the URL to the secure ArcGIS Server. users who find this then in the geoportal and try to open it would either be recognized by the server or would be prompted for credentials/rejected access.