A tool like adfind by MVP Joe Richards can really help here
http://www.joeware.net/freetools/tools/adfind/index.htm
adfind -default -f "&(objectcategory=person)(objectclass=user)(userCertificate=*)" samaccountname
want to know if they don't have one just add a ! (not) in front of userCertificate
adfind -default -f "&(objectcategory=person)(objectclass=user)(!userCertificate=*)" samaccountname
Let me know how that works
Thanks
Mike