If you are using cert based authentication, it would not check if the account is locked. Since LDAP is used for authorization, you would need to check for an attribute that would correlated if an account is locked and use the results to perform a role map to no roles.
After reading some documentation from MS, it seems there is a large variety of statuses a user account can be in that would result in a locked account. My recommendation would be trying to use LDAP as the primary authentication with a certificate restriction on the realm. It would give similar behavior and would fail auth if the account is locked.
